Sentinel, Threat Detection, Auditd, Information Security, Blue Team.
specified key filter-null-keys = false # Filter events that were constructed from input lines matching these # regular expressions # filter-raw-lines = [ # "^type=PATH msg=\\S*? item=\\S*? name=\"/var/run/nscd[.]sock\" " # ] # Keep the first event observed for any given process even if it would #