Sentinel, Threat Detection, Auditd, Information Security, Blue Team.
be filtered otherwise. This should only be turned off if # reproducible process tracking or process tree reconstruction is not # required. # keep-first-per-processes = true # What to do with filtered events? "drop" or "log" to the filterlog # defined above. filter-action = "drop" If you ever need