I'm discouraged to see that a year and a half later, this question has gone unanswered, and there are similar unanswered questions peppered throughout this portal. How are we supposed to use detection rules with VSAs? I kind of get the feeling that Symantec doesn't really want us to use Symantec Workspace Virtualization.

I found a workaround here https://www-secure.symantec.com/connect/forums/detection-rules-swv-cms7, but it's still a bit of work, and it might not even be applicable to the latest versions of SWV, which don't use an MSI to install the SWV agent (which apparently the solution requires).