{
  "pluginPath": {
    "shutdown": "/sysevents/shutdown",
    "wmi": "/sysevents/wmi",
    "reloadConfig": "/sysevents/config/refresh"
  },
  "agentPath": {
    "data": "/sysevents/data"
  },
  "logLevel": "ERROR",
  "maxLogFileSizeInMB": 1,
  "oldLogFileToKeep": 5,
  "filesystemColdstartDelaySec": 300,
  "registryColdstartDelaySec": 360,
  "registryPluginAPIpath": "/registry/registry/keyValue",
  "filesystemPluginAPIpath":"/filesystem/filesystem/getFileSystemState",
  "filesystemPollingIntervalMilSec":30000,
  "missedKeysPollIntervalMilSec":30000,
  "EnableSecDescOnNamedPipe": false,
  "serviceLimit": 2000,
  "snapshotDiffThreshold": 50,
  "maxRetryAttempt": 3,
  "enablePluginDataPersist": true,
  "events": [
    {
      "name":"assetService",
      "pluginPaths": [],
      "brokerPath": "/service",
      "type":"service",
      "api": {
        "thresholdServiceInSec": 60,
        "thresholdFreqServiceInMultiples": 2,
        "discardServices": ["WinHttpAutoProxySvc","wmiApSrv","WerSvc","MapsBroker","wlidsvc","tiledatamodelsvc","ClipSVC","defragsvc","DsSvc","swprv","TrustedInstaller","AppXSvc","WdiSystemHost","wisvc","TapiSrv","UserManager","Appinfo","NgcSvc","SmsRouter","PhoneSvc","StorSvc","SensorService","wlpasvc","PolicyAgent","lfsvc","EFS","DsmSvc","DeviceInstall","gupdatem","WPDBusEnum","WaaSMedicSvc","FrameServer","fhsvc","WalletService","vds","VacSvc","msiserver","NgcCtnrSvc","diagnosticshub.standardcollector.service","InstallService","CscService","WSearch","NetSetupSvc","RmSvc","tzautoupdate","UsoSvc"],
        "alertServices": ["cdp","AAC_AGENT","ADAM_VMwareVCMSDS","ADSync","APCPBEAgent","APCPBEServer","ASMBENotify","AVG8AdminServer","AVG9AdminServer","AVGEMS","AVGTCPSv","AdaptecStorageManagerAgent","AlertManager","Amsp","Avg7Alrt","Avg7UpdSvc","AvgAdminServer","AzureADConnectHealthSyncInsights","AzureADConnectHealthSyncMonitor","BAS-AS","BAS-NCC","BBAttachServer","BDFILED","BDFILED2","BDFS","BDLIVED2","BDMAILD","BDMAILD2","BDSCAND2","BDUPDSVR","BackupExecAgentAccelerator","BackupExecAgentBrowser","BackupExecDeviceMediaService","BackupExecJobEngine","BackupExecRPCService","BitDefender Management Agent","BitDefender Management Server","BlackBerry Controller","BlackBerry Database Consistency Service","BlackBerry Dispatcher","BlackBerry MDS Connection Service","BlackBerry MailStore Service","BlackBerry Mobile Data Service","BlackBerry Policy Service","BlackBerry Router","BlackBerry Server Alert","BlackBerry SyncServer","CAEService","CIMnotify","CIOArrayManagement","CIOEventNotifier","CLPSLauncher","CRepSrv","CTXCPUBal","CdfSvc","CdmService","CesmAgentService","CesmProxyService","CesmService","CesmVncServer","Citrix 64-bit Virtual Memory Optimization","Citrix Encryption Service","Citrix Licensing","Citrix SMA Service","Citrix Virtual Memory Optimization","CitrixCseEngine","CitrixHealthMon","CitrixLicensing","CitrixProtocolTransition","CitrixWMIService","CitrixXTEServer","Citrix_GTLicensingProv","CpqRcmc","CqMgHost","CryptoPreventEmail","CryptoPreventFolderWatch","CryptoPreventMonSvc","CtxAudioSvc","CtxFlashSvc","CtxHttp","CtxLSPortSvc","CtxSecGwy","CtxSmartCardSvc","DCLauncher","DCLauncher14","DCLoadBalancer","DCLoadBalancer14","DFSR","DHCPServer","DNS","DbaRpcService","DefWatch","Dfs","Dhcp","ECSLOGD","Encryption Service","EventLog","FMS","FTA","FWSRV","FontCache","GKSVC","HostControllerService","IAANTMon","IISADMIN","IKEEXT","IMAAdvanceSrv","IMAP4Svc","IMAService","IOManager","ISACTRL","ISASTG","IcePack","InoNmSrv","InoRPC","InoRT","InoTask","IsmServ","Kdc","LSM","LUService","LanmanServer","LanmanWorkstation","LiebertM","MASTER","MFCom","MSComplianceAudit","MSDTC","MSExchangeAB","MSExchangeADTopology","MSExchangeAntispamUpdate","MSExchangeCompliance","MSExchangeDS","MSExchangeDagMgmt","MSExchangeDelivery","MSExchangeDiagnostics","MSExchangeES","MSExchangeEdgeSync","MSExchangeFBA","MSExchangeFDS","MSExchangeFastSearch","MSExchangeFrontEndTransport","MSExchangeHM","MSExchangeHMRecovery","MSExchangeIMAP4BE","MSExchangeIS","MSExchangeImap4","MSExchangeMGMT","MSExchangeMTA","MSExchangeMailSubmission","MSExchangeMailboxAssistants","MSExchangeMailboxReplication","MSExchangeMonitoring","MSExchangeNotificationsBroker","MSExchangePOP3BE","MSExchangePop3","MSExchangeRPC","MSExchangeRepl","MSExchangeSA","MSExchangeSRS","MSExchangeSearch","MSExchangeServiceHost","MSExchangeSubmission","MSExchangeThrottling","MSExchangeTransport","MSExchangeTransportLogSearch","MSExchangeUM","MSExchangeUMCR","MSFtpsvc","MSOnlineSyncScheduler","MSPOP3Connector","MSSQL$BKUPEXEC","MSSQL$BLACKBERRY","MSSQL$SOPHOS","MSSQL$SQLEXPRESS","MSSQLServer","MSSQLServerADHelper","MSSQLServerADHelper100","McAfee GroupShield","McAfeeFramework","McShield","McTaskManager","MicrosoftDynamicsNavServer","MicrosoftDynamicsNavWS","MpsSvc","MsDtsServer100","MsDtsServer110","NPEMCLIENT3","NetRAID","Netlogon","Network Associates Log Service","NinjaCloudSvc","NinjaPimsvc","NinjaRemSvc","NinjaStoreSvc","NinjaUpdSvc","NinjaWatchSvc","NlaSvc","Norton AntiVirus Server","OSearch14","OSearch15","OfcAoSMgr","OfcPfwSvc","Osearch","Outbreak Manager","Pop3Svc","Power","PowerAlert Server","PowerAlert UPS Engine","PowerChuteNetShut","ProfSvc","RAIDStorAgent","RAID_SERVER","RAIDmAgt","RDMS","REG_SERVER","REPLICA","RESvc","RTCASMCU","RTCATS","RTCAVMCU","RTCCAA","RTCCAS","RTCCDR","RTCCHAT","RTCCLSAGT","RTCCPS","RTCDATAMCU","RTCDATAPROXY","RTCIMMCU","RTCLOG","RTCMEDIARELAY","RTCMEDSRV","RTCMEETINGMCU","RTCMRAUTH","RTCPDPAUTH","RTCPDPCORE","RTCRGS","RTCXMPPTGW","RadeHlprSvc","RadeSvc","RemoteAccess","RpcEptMapper","RpcSs","RtcQms","RtcSrv","SAVAdminService","SAVService","SBAMSvc","SBCore","SENS","SMSMSE","SMSSMTP","SMTPSVC","SNAC","SPAdmin","SPSearch","SPSearch4","SPSearchHostController","SPTimerV3","SPTrace","SPWriter","SPXService","SQLAgent$SBSMONITORING","SQLAgent$SHAREPOINT","SQLBrowser","SQLServerAgent","SQLWriter","SamSs","ScanExplicit","ScanMail_MailAction","ScanMail_Monitor","ScanMail_RealTimeScan","Schedule","SepMasterService","SepMasterServiceMig","Serv-U","Server Administrator","SessionEnv","ShadowProtectSvc","SmcService","Sophos Agent","Sophos AutoUpdate Agent","SpamCure","Spooler","SsPaAdm","StorageCraft Image Manager","Sunbelt Software Enterprise Service","SymWSC","Symantec AntiVirus","SystemEventsBroker","TMiCRCScanService","TSGateway","TScPubRPC","TermServLicensing","TermService","Themes","TmProxy","Tssdis","UALSVC","UlmService","UmRdpService","Update Server","VIPRE Business Service","VMTools","VMnetDHCP","VMware Authorization Service","VMware NAT Service","VMwareHostd","VMwareServerWebAccess","VSNAPVSS","Veritas_Oracle_Agent","W32Time","W3PROXY","W3SVC","WLMS","WRSVC","Wcmsvc","WebAnalyticsService","WinRM","Winmgmt","aacevt","adfssrv","asperasync","avg8wd","avg9emc","avg9wd","avgagent","avgwd","ccEvtMgr","ccEvtMgr","ccPwdSvc","ccSetMgr","ccSetMgr","cmdAgent","cmdvirth","cpqsrhmo","cpsvc","ctxcpuSched","dcevt32","dcevt64","dcstor32","dcstor64","eCS_Transport","eTFWService","eTrust Antivirus Gateway HTTP","eTrust Antivirus Gateway SMTP","hpdiags","hptsvr","ifssvc","invsvc","iphlpsvc","lmhosts","msftesql-Exchange","myAgtSvc","navapsvc","nsi","ntrtscan","ofcservice","omsad","psmserv","qserver","semsrv","ssPaSetMgr","ssSpnAv","stc_raw_agent","tmlisten","unirpc","vCOConfiguration","vPostgres","vctomcat","vmicguestinterface","vmicheartbeat","vmickvpexchange","vmicrdv","vmicshutdown","vmictimesync","vmicvss","vmms","vmware-license","vmware-ufad-vci","vpxd","vspherewebclientsvc","wBAMon","wBackupAssist","wsbexchange","xensvc"],
        "pollingIntervalInSec": 10
      }
    },
    {
      "name":"perfProcess",
      "pluginPaths": [],
      "brokerPath": "/perfProcess",
      "type":"process",
      "sendSnapShotOnStartUp": true,
      "api": {
        "alertServices": [""],
        "pollingIntervalInSec": 10,
        "sendFullSnapshotInSeconds": 86400
      }
    },
    {
      "name":"assetShare",
      "pluginPaths": ["/asset/asset/share"],
      "brokerPath": "",
      "type":"share",
      "api": {
        "pollingIntervalInSec": 30
      }
    },  
    {
      "name":"assetUser",
      "pluginPaths": ["/asset/asset/user"],
      "brokerPath": "",
      "type":"user",
      "api": {
        "pollingIntervalInSec": 30
      }
    },
    {
      "name":"assetDisk",
      "pluginPaths": ["/asset/asset/drive"],
      "brokerPath": "",
      "type":"disk",
      "api": {
        "pollingIntervalInSec": 30
      }
    },
    {
      "name":"assetNet",
      "pluginPaths": ["/asset/asset/network"],
      "brokerPath": "",
      "type":"net",
      "api": {
        "pollingIntervalInSec": 30
      }
    },
    {
      "name":"installedSoftware64",
      "pluginPaths": ["/asset/asset/installedSoftware","/remoteaccess/remoteaccess/uninstall"],
      "type":"registry",
      "api": {
        "path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
        "notificationType":"regNotifyChangeName",
        "watchForChild": 1
      }
    },
    {
      "name":"installedSoftware32",
      "pluginPaths": ["/asset/asset/installedSoftware","/remoteaccess/remoteaccess/uninstall"],
      "type":"registry",
      "api": {
        "path": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
        "notificationType":"regNotifyChangeName",
        "watchForChild": 1
      }
    }
  ],

  "shutdownTimeout": "1m",

  "includes":[
      "../plugin/registry/registry_keys.json",
      "../plugin/filesystem/filesystem_paths.json"
  ]
}
