{
  "pluginPath": {
    "shutdown": "/eventlog/shutdown",
    "reload": "/eventlog/config/refresh",
    "addRule": "/eventlog/add_rule",
    "deleteRule": "/eventlog/delete_rule"
  },
  "agentPath": {
    "data": "/eventlog/data"
  },
  "logLevel":"INFO",
  "maxLogFileSizeInMB":1,
  "oldLogFileToKeep":5,
  "EnableSecDescOnNamedPipe": false,
  "globalFetchTime": "15m",
  "rules": [
    {
      "collector": "winlog",
      "description": "Error on Disk FileSystem Event",
      "eventDetails": {
        "facility": 17,
        "source": "Ntfs",
        "eventIDs": ["55"],
          "severity": [3,4]
      },
      "filters": [{
        "field": "description",
        "negativeMatch": "(?i).*\\b(?:Temp|HarddiskVolumeShadowCopy)\\b.*"
      }]
    },
    {
      "collector": "winlog",
      "description": "Required Machine Restart",
      "eventDetails": {
        "facility": 18,
        "source": "RestartManager",
        "eventIDs": ["10005"],
        "severity": [4, 5]
      },
      "filters": [{
        "field": "description",
        "positiveMatch": "(?i)Machine restart is required"
      }]
    },
    {
      "collector": "winlog",
      "description": "Required Machine Restart",
      "eventDetails": {
        "facility": 17,
        "source": "Microsoft-Windows-WindowsUpdateClient",
        "eventIDs": ["21"],
        "severity": [4, 5]
      }
    },
    {
      "collector": "winlog",
      "description": "6008: Unexpected reboot / 6005: Event Log service was started",
      "eventDetails": {
        "facility": 17,
        "source": "EventLog",
        "eventIDs": ["6008","6005"],
        "severity": [3, 5],
        "fetchTime": "5m"
      }
    },
    {
      "collector": "winlog",
      "description": "Unexpected reboot (Recovered from BSOD)",
      "eventDetails": {
        "facility": 17,
        "source": "Microsoft-Windows-WER-SystemErrorReporting",
        "eventIDs": ["1001"],
        "severity": [3, 5],
        "fetchTime": "5m"
      }
    },
    {
      "collector": "winlog",
      "description": "Corrupt file popup",
      "eventDetails": {
        "facility": 17,
        "source": "Application popup",
        "eventIDs": ["26"],
        "severity": [3]
      },
      "filters": [{
        "field": "description",
        "positiveMatch": "(?i)Corrupt File"
      }]

    },
    {
      "collector": "winlog",
      "description": "",
      "eventDetails": {
        "facility": 18,
        "source": "Windows Backup",
        "eventIDs": ["4097", "4098", "4104"],
        "severity": [3, 5]
      }
    },
    {
      "collector": "winlog",
      "description": "",
      "eventDetails": {
        "facility": 18,
        "source": "Microsoft-Windows-Backup",
        "eventIDs": ["753", "754", "517"],
        "severity": [3, 5]
      }
    },
    {
      "collector": "syslog",
      "description": "Test event",
      "eventDetails": {
        "source": "systemd",
        "facility": 1,
        "severity": [6,4],
        "fetchTime": "5m"
      },
      "filters": [{
        "field": "description",
        "positiveMatch": "(?i).*Test.*"
      },{
        "field": "source",
        "negativeMatch": "(?i).*Test.*"
      }]
    },
    {
      "collector": "winlog",
      "description": "Agent Tamper Protection - Access Failure Log",
      "eventDetails": {
        "source": "Microsoft-Windows-Security-Auditing",
        "facility": 16,
        "eventIDs": ["4656"],
        "severity": [3,5]
      },
      "filters": [{
        "field": "description",
        "positiveMatch": "(?i).*Object Type:\t\tSERVICE OBJECT\n\tObject Name:\t\tITSPlatform.*"
      }]
    }  
  ],
  "rSyslogFilePath": "/var/log/agent.log",
  "flushInterval": 0,
  "timeCheck": 1000,
  "maxTime": 5,
  "maxMessageLength": 100000,
  "shutdownTimeout": "1m",
  "minSleepStartupInSeconds": "2",
  "maxSleepStartupInSeconds": "5"
}
