Sentinel, Threat Detection, Auditd, Information Security, Blue Team.
useful for marking an entire subtree of children that have been # spawned within certain contexts (e.g. system management tools, # container runtimes, ssh servers, cron, etc.). propagate-labels = [ "software_mgmt", "amazon-ssm-agent" ] [filter] # When audit records with attached keys are being