expr/testdata/crowdsec.json

[
  " {Jan:'01',Feb:'02',Mar:'03',Apr:'04',May:'05',Jun:'06',Jul:'07',Aug:'08',Sep:'09',Oct:'10',Nov:'11',Dec:'12'}[evt.Parsed.ts_m] + '/' + evt.Parsed.ts_d + '/' + evt.Parsed.ts_y + ' ' + evt.Parsed.ts_t",
  "\"20\" + evt.Parsed.year + \"/\" + evt.Parsed.month + \"/\" + evt.Parsed.day + \" \" + evt.Parsed.time",
  "'source_ip' in evt.Meta",
  "(\nUpper(evt.Meta.http_path) contains Upper('/service/extension/backup/mboximport?account-name=admin&ow=2&no-switch=1&append=1') ||\nUpper(evt.Meta.http_path) contains Upper('/service/extension/backup/mboximport?account-name=admin&account-status=1&ow=cmd') \n)\nand evt.Meta.http_status startsWith ('40') and\nUpper(evt.Meta.http_verb) == 'POST'\n",
  "GetFromStash(\"auditd_pid_progname\", evt.Unmarshaled.auditd.ppid)",
  "IpToRange(evt.Overflow.Alert.Source.IP, \"/64\")",
  "IsIP(evt.Unmarshaled.cloudtrail.sourceIPAddress) ? evt.Unmarshaled.cloudtrail.sourceIPAddress : \"\"\n",
  "JsonExtract(evt.Line.Raw, \"common_log\")",
  "JsonExtract(evt.Line.Raw, \"metric_name\")",
  "JsonExtract(evt.Line.Raw, \"path_info\")",
  "JsonExtract(evt.Line.Raw, \"request.headers.User-Agent\")",
  "JsonExtract(evt.Line.Raw, \"request.host\")",
  "JsonExtract(evt.Line.Raw, \"request.method\")",
  "JsonExtract(evt.Line.Raw, \"request.remote_addr\")",
  "JsonExtract(evt.Line.Raw, \"request.remote_ip\")",
  "JsonExtract(evt.Line.Raw, \"request.uri\")",
  "JsonExtract(evt.Line.Raw, \"request_ip\")",
  "JsonExtract(evt.Line.Raw, \"resp_headers.Date[0]\")",
  "JsonExtract(evt.Line.Raw, \"status\")",
  "JsonExtract(evt.Line.Raw, \"time\")",
  "JsonExtract(evt.Line.Raw, \"timestamp\")",
  "JsonExtract(evt.Line.Raw, \"user_agent\")",
  "JsonExtract(evt.Line.Raw, 'status') == '401' && JsonExtract(evt.Line.Raw, 'request.headers.Authorization[0]') startsWith 'Basic ' ? 'auth_fail' : ''",
  "JsonExtract(evt.Parsed.line, \"bouncer_agent\")",
  "JsonExtract(evt.Parsed.line, \"customer_id\")",
  "JsonExtract(evt.Parsed.line, \"ip\")",
  "JsonExtract(evt.Parsed.line, \"order_id\")",
  "JsonExtract(evt.Parsed.line, \"payment_method\")",
  "JsonExtract(evt.Parsed.line, \"product_id\")",
  "JsonExtract(evt.Parsed.line, \"quote_id\")",
  "JsonExtract(evt.Parsed.line, \"type\")",
  "JsonExtract(evt.Parsed.line, \"x-forwarded-for-ip\")",
  "JsonExtract(evt.Parsed.message, \"alert.rev\")",
  "JsonExtract(evt.Parsed.message, \"alert.severity\")",
  "JsonExtract(evt.Parsed.message, \"alert.signature\")",
  "JsonExtract(evt.Parsed.message, \"alert.signature_id\")",
  "JsonExtract(evt.Parsed.message, \"attr.authenticationDatabase\")",
  "JsonExtract(evt.Parsed.message, \"attr.principalName\")",
  "JsonExtract(evt.Parsed.message, \"attr.remote\")",
  "JsonExtract(evt.Parsed.message, \"client_ip\")",
  "JsonExtract(evt.Parsed.message, \"dest_ip\")",
  "JsonExtract(evt.Parsed.message, \"dest_port\")",
  "JsonExtract(evt.Parsed.message, \"eventAudience\")",
  "JsonExtract(evt.Parsed.message, \"eventData.eventConfidence\")",
  "JsonExtract(evt.Parsed.message, \"eventData.httpSourceId\")",
  "JsonExtract(evt.Parsed.message, \"eventData.matchedLocation\")",
  "JsonExtract(evt.Parsed.message, \"eventData.matchedParameter\")",
  "JsonExtract(evt.Parsed.message, \"eventData.matchedSample\")",
  "JsonExtract(evt.Parsed.message, \"eventData.securityAction\")",
  "JsonExtract(evt.Parsed.message, \"eventData.sourceIP\")",
  "JsonExtract(evt.Parsed.message, \"eventData.waapIncidentType\")",
  "JsonExtract(evt.Parsed.message, \"eventName\")",
  "JsonExtract(evt.Parsed.message, \"eventPriority\")",
  "JsonExtract(evt.Parsed.message, \"eventSeverity\")",
  "JsonExtract(evt.Parsed.message, \"eventTime\")",
  "JsonExtract(evt.Parsed.message, \"flow_id\")",
  "JsonExtract(evt.Parsed.message, \"message\")",
  "JsonExtract(evt.Parsed.message, \"msg\")",
  "JsonExtract(evt.Parsed.message, \"proto\")",
  "JsonExtract(evt.Parsed.message, \"remote_ip\")",
  "JsonExtract(evt.Parsed.message, \"request_method\")",
  "JsonExtract(evt.Parsed.message, \"request_referer\")",
  "JsonExtract(evt.Parsed.message, \"request_user_agent\")",
  "JsonExtract(evt.Parsed.message, \"response_body_size\")",
  "JsonExtract(evt.Parsed.message, \"response_status\")",
  "JsonExtract(evt.Parsed.message, \"src_ip\")",
  "JsonExtract(evt.Parsed.message, \"t.$date\")",
  "JsonExtract(evt.Parsed.message, \"time\")",
  "JsonExtract(evt.Parsed.message, \"timestamp\")",
  "JsonExtract(evt.Parsed.message, \"url\")",
  "JsonExtractUnescape(evt.Line.Raw, \"log\")",
  "Lower(evt.Meta.http_path) contains '/index.php' &&\nUpper(evt.Parsed.verb) == 'POST' &&\nevt.Meta.http_status == '302' &&\nLower(evt.Parsed.http_args) matches 'login=.*[$|%24][\\\\(|%28].*[\\\\)|%29]'\n",
  "Lower(evt.Unmarshaled.iptables.PROTO)",
  "ParseKV(evt.Parsed.message, evt.Unmarshaled, \"iptables\")",
  "RegexpInFile(evt.Enriched.reverse_dns, 'rdns_seo_bots.regex')",
  "Split(evt.Unmarshaled.traefik.ClientAddr, ':')[0]",
  "Split(evt.Unmarshaled.traefik.RequestProtocol, '/')[1]",
  "UnmarshalJSON(evt.Line.Raw, evt.Unmarshaled, \"k8s_audit\")",
  "UnmarshalJSON(evt.Line.Raw, evt.Unmarshaled, 'cloudtrail')",
  "Upper(PathUnescape(evt.Meta.http_path)) contains Upper('${script:javascript:java.lang.Runtime.getRuntime().exec(')\nor\nUpper(PathUnescape(evt.Meta.http_path)) contains Upper('${script:js:java.lang.Runtime.getRuntime().exec(')\nor\nUpper(PathUnescape(evt.Meta.http_path)) contains Upper('${url:UTF-8:') \nor\nUpper(PathUnescape(evt.Meta.http_path)) contains Upper('${dns:address|') \n",
  "Upper(PathUnescape(evt.Meta.http_path)) contains Upper('@java.lang.Runtime@getRuntime().exec(')",
  "Upper(evt.Meta.http_path) contains Upper('/autodiscover/autodiscover.json') &&\nUpper(evt.Parsed.http_args) contains Upper('powershell')\n",
  "Upper(evt.Meta.http_path) contains Upper('/ghost/api/admin/session') &&\nUpper(evt.Parsed.verb) == 'POST' &&\nevt.Meta.http_status == '404'\n",
  "Upper(evt.Meta.http_path) contains Upper('/remote_agent.php') &&\nUpper(evt.Parsed.verb) == 'GET' &&\nLower(evt.Parsed.http_args) contains 'action=polldata' &&\nLower(evt.Parsed.http_args) matches 'poller_id=.*(;|%3b)'\n",
  "Upper(evt.Meta.http_path) contains Upper('/remote_agent.php') &&\nUpper(evt.Parsed.verb) == 'GET' &&\nLower(evt.Parsed.http_args) contains 'host_id' &&\nLower(evt.Parsed.http_args) contains 'local_data_ids'\n",
  "Upper(evt.Meta.http_path) contains Upper('/vendor/htmlawed/htmlawed/htmLawedTest.php')",
  "Upper(evt.Parsed.file_ext) in ['.JPG', '.CSS', '.JS', '.JPEG', '.PNG', '.SVG', '.MAP', '.ICO', '.OTF', '.GIF', '.MP3', '.MP4', '.WOFF', '.WOFF2', '.TTF', '.OTF', '.EOT', '.WEBP', '.WAV', '.GZ', '.BROTLI', '.BVR', '.TS', '.BMP'] ? 'true' : 'false'",
  "Upper(evt.Parsed.program) == 'BAIKAL'",
  "Upper(evt.Parsed.program) == 'GITLAB'",
  "Upper(evt.Parsed.program) == 'MONGODB'",
  "Upper(evt.Parsed.program) == 'NAMED'",
  "Upper(evt.Parsed.program) == 'NEXTCLOUD'",
  "Upper(evt.Parsed.program) == 'PAPERLESS-NGX'",
  "Upper(evt.Parsed.program) == 'UPTIME-KUMA'",
  "Upper(evt.Parsed.program) == 'VAULTWARDEN'",
  "Upper(evt.Parsed.program) == 'WEBMIN'",
  "XMLGetAttributeValue(evt.Line.Raw, \"/Event/System[1]/Provider\", \"Name\")",
  "XMLGetAttributeValue(evt.Line.Raw, \"/Event/System[1]/Security\", \"UserID\")",
  "XMLGetAttributeValue(evt.Line.Raw, \"/Event/System[1]/TimeCreated\", \"SystemTime\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[1]\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[2]\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[3]\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Archived']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='CallTrace']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ClientInfo']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='CommandLine']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Company']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Configuration']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ConfigurationFileHash']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Consumer']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='CreationUtcTime']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='CurrentDirectory']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Description']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Destination']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='DestinationHostname']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='DestinationIp']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='DestinationIsIpv6']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='DestinationPort']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='DestinationPortName']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Details']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Device']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='EventNamespace']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='EventType']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='FileVersion']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Filter']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='GrantedAccess']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Hashes']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Image']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ImageLoaded']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Initiated']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='IntegrityLevel']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='IpAddress']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='IsExecutable']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='LogonGuid']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='LogonId']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Name']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='NewName']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='NewThreadId']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Operation']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='OriginalFileName']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ParentCommandLine']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ParentImage']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ParentProcessGuid']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ParentProcessId']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ParentUser']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='PipeName']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ProcessGuid']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ProcessId']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Protocol']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Query']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='QueryName']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='QueryResults']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='QueryStatus']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='RuleName']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SchemaVersion']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Session']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Signature']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SignatureStatus']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Signed']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourceHostname']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourceImage']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourceIp']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourceIsIpv6']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourcePort']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourcePortName']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourceProcessGUID']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourceProcessGuid']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourceProcessId']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourceThreadId']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='StartAddress']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='StartFunction']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='StartModule']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='State']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='TargetFilename']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='TargetImage']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='TargetObject']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='TargetProcessGUID']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='TargetProcessGuid']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='TargetProcessId']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='TargetUserName']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='TerminalSessionId']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Type']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='User']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Version']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='c-ip']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='cs-method']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='cs-uri-query']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='cs-uri-stem']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='csUser-Agent']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='date']\") + \" \" + XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='time']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='s-sitename']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='sc-status']\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/System[1]/Channel\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/System[1]/Computer\")",
  "XMLGetNodeValue(evt.Line.Raw, \"/Event/System[1]/EventID\")",
  "all(evt.Overflow.Alert.Events, {.GetMeta('parent_progname') in ['/usr/bin/dpkg', '/usr/bin/dnf']})",
  "any(File('cloudflare_ip6s.txt'), { IpInRange(evt.Overflow.Alert.Source.IP ,#)})",
  "any(File('cloudflare_ips.txt'), { IpInRange(evt.Overflow.Alert.Source.IP ,#)})",
  "any(File('ip_seo_bots.txt'), { len(#) > 0 && IpInRange(evt.Overflow.Alert.Source.IP ,#)})",
  "any(File('rdns_seo_bots.txt'), { len(#) > 0 && evt.Enriched.reverse_dns endsWith #})",
  "any(['Authentication failure', 'Password mismatch', 'password mismatch', 'auth failed', 'unknown user'], {evt.Parsed.dovecot_login_message contains #}) ? 'auth_failed' : ''",
  "evt.Enriched.ASNNumber",
  "evt.Enriched.ASNOrg",
  "evt.Enriched.GeoCoords",
  "evt.Enriched.IsInEU",
  "evt.Enriched.IsoCode",
  "evt.Enriched.MarshaledTime",
  "evt.Enriched.SourceRange",
  "evt.Enriched.reverse_dns",
  "evt.Enriched.reverse_dns endsWith '.ptr.discord.com.'",
  "evt.GetType() == 'overflow' && evt.Overflow.Alert.Remediation == true",
  "evt.Line.Labels.external_format == 'fastly'",
  "evt.Line.Labels.program",
  "evt.Line.Labels.type",
  "evt.Line.Labels.type != 'syslog'",
  "evt.Line.Labels.type == 'aws-alb'",
  "evt.Line.Labels.type == 'containerd'",
  "evt.Line.Labels.type == 'docker'",
  "evt.Line.Labels.type == 'syslog'",
  "evt.Line.Labels.type == 'unifi'",
  "evt.Line.Module",
  "evt.Line.Module != 'wineventlog'",
  "evt.Line.Module == 'wineventlog'",
  "evt.Line.Raw",
  "evt.Line.Src",
  "evt.Meta.error in ['user_not_found', 'invalid_user_credentials']",
  "evt.Meta.http_path + '?' + evt.Parsed.http_args",
  "evt.Meta.http_status == '200' && evt.Parsed.static_ressource == 'false' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/photos/api/v1/preview' && evt.Parsed.http_args contains '&x=' && evt.Parsed.http_args contains '&y=' && evt.Parsed.http_args contains 'etag='",
  "evt.Meta.http_status == '403' && evt.Meta.http_verb == 'POST' && evt.Meta.http_path contains \"/Sessions/Playing/Progress\"",
  "evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/files_trashbin/preview' && evt.Parsed.http_args contains 'fileId=' && evt.Parsed.http_args contains '&file='",
  "evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/files_versions/preview' && evt.Parsed.http_args contains 'version'",
  "evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/photos/api/v1/preview' && evt.Parsed.http_args contains 'x' && evt.Parsed.http_args contains 'y'",
  "evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path matches '\\\\/apps\\\\/files\\\\/api\\\\/v1\\\\/thumbnail\\\\/(\\\\d+)/(\\\\d+)'",
  "evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path startsWith '/apps/mail/api/avatars/url/'",
  "evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Parsed.file_ext == '.vcf' && evt.Parsed.http_args contains \"photo\"",
  "evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Parsed.request == '/ocs/v2.php/apps/text/workspace' && evt.Parsed.http_args contains 'path=%2F'",
  "evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Parsed.request contains '/core/preview' && evt.Parsed.http_args contains 'x=' && evt.Parsed.http_args contains 'y=' && evt.Parsed.http_args contains 'fileId='",
  "evt.Meta.http_status == '404' && evt.Meta.http_verb in ['PROPFIND', 'GET'] && evt.Meta.http_path matches '^/remote.php/(web)?dav/'",
  "evt.Meta.http_status in ['404', '403', '502'] ? 'false' : 'true'",
  "evt.Meta.log_subtype == 'zm_bad_password'",
  "evt.Meta.log_subtype == 'zm_bad_user'",
  "evt.Meta.log_type  == 'gotify_failed_auth'",
  "evt.Meta.log_type == \"palo_alto\" && evt.Meta.severity in [\"medium\", \"high\", \"critical\"]",
  "evt.Meta.log_type == 'ADMIN_LOGIN_FAILED'",
  "evt.Meta.log_type == 'CVE-2021-4034-xpl'",
  "evt.Meta.log_type == 'PAYMENT_FAILED'",
  "evt.Meta.log_type == 'PAYMENT_FAILED' and evt.Meta.ASNNumber != '' ",
  "evt.Meta.log_type == 'PAYMENT_FAILED' and evt.Meta.IsoCode != '' ",
  "evt.Meta.log_type == 'adguardhome_failed_auth'",
  "evt.Meta.log_type == 'apache-guacamole_failed_auth'",
  "evt.Meta.log_type == 'asterisk_failed_auth'",
  "evt.Meta.log_type == 'auth_bf_attempt'",
  "evt.Meta.log_type == 'auth_bf_log'",
  "evt.Meta.log_type == 'aws-cloudtrail'",
  "evt.Meta.log_type == 'aws-cloudtrail' &&\n(\n     (evt.Unmarshaled.cloudtrail.errorCode != nil && evt.Unmarshaled.cloudtrail.errorCode matches \".*UnauthorizedOperation$\") ||\n     (evt.Unmarshaled.cloudtrail.errorCode != nil && evt.Unmarshaled.cloudtrail.errorCode matches \"^AccessDenied.*\")\n)\n",
  "evt.Meta.log_type == 'aws-cloudtrail' &&\n(\n  evt.Meta.event_name == \"DeleteGroupPolicy\" ||\n  evt.Meta.event_name == \"DeleteRolePolicy\" ||\n  evt.Meta.event_name == \"DeleteUserPolicy\" ||\n  evt.Meta.event_name == \"PutGroupPolicy\" ||\n  evt.Meta.event_name == \"PutRolePolicy\" ||\n  evt.Meta.event_name == \"PutUserPolicy\" ||\n  evt.Meta.event_name == \"CreatePolicy\" ||\n  evt.Meta.event_name == \"DeletePolicy\" ||\n  evt.Meta.event_name == \"CreatePolicyVersion\" ||\n  evt.Meta.event_name == \"DeletePolicyVersion\" ||\n  evt.Meta.event_name == \"AttachRolePolicy\" ||\n  evt.Meta.event_name == \"DetachRolePolicy\" ||\n  evt.Meta.event_name == \"AttachUserPolicy\" ||\n  evt.Meta.event_name == \"DetachUserPolicy\" ||\n  evt.Meta.event_name == \"AttachGroupPolicy\" ||\n  evt.Meta.event_name == \"DetachGroupPolicy\"\n)\n",
  "evt.Meta.log_type == 'aws-cloudtrail' &&\n(\nevt.Meta.event_name == \"AuthorizeSecurityGroupIngress\" ||\nevt.Meta.event_name == \"AuthorizeSecurityGroupEgress\" ||\nevt.Meta.event_name == \"RevokeSecurityGroupIngress\" ||\nevt.Meta.event_name == \"RevokeSecurityGroupEgress\" ||\nevt.Meta.event_name == \"CreateSecurityGroup\" ||\nevt.Meta.event_name == \"DeleteSecurityGroup\"\n)\n",
  "evt.Meta.log_type == 'aws-cloudtrail' &&\n(\nevt.Meta.event_name == \"CreateCustomerGateway\" ||\nevt.Meta.event_name == \"DeleteCustomerGateway\" ||\nevt.Meta.event_name == \"AttachInternetGateway\" ||\nevt.Meta.event_name == \"CreateInternetGateway\" ||\nevt.Meta.event_name == \"DeleteInternetGateway\" ||\nevt.Meta.event_name == \"DetachInternetGateway\"\n)\n",
  "evt.Meta.log_type == 'aws-cloudtrail' &&\n(\nevt.Meta.event_name == \"CreateNetworkAcl\" ||\nevt.Meta.event_name == \"CreateNetworkAclEntry\" ||\nevt.Meta.event_name == \"DeleteNetworkAcl\" ||\nevt.Meta.event_name == \"DeleteNetworkAclEntry\" ||\nevt.Meta.event_name == \"ReplaceNetworkAclEntry\" ||\nevt.Meta.event_name == \"ReplaceNetworkAclAssociation\"\n)\n",
  "evt.Meta.log_type == 'aws-cloudtrail' &&\n(\nevt.Meta.event_name == \"CreateRoute\" ||\nevt.Meta.event_name == \"CreateRouteTable\" ||\nevt.Meta.event_name == \"ReplaceRoute\" ||\nevt.Meta.event_name == \"ReplaceRouteTableAssociation\" ||\nevt.Meta.event_name == \"DeleteRouteTable\" ||\nevt.Meta.event_name == \"DeleteRoute\" ||\nevt.Meta.event_name == \"DisassociateRouteTable\"\n)\n",
  "evt.Meta.log_type == 'aws-cloudtrail' &&\n(\nevt.Meta.event_name == \"CreateTrail\" ||\nevt.Meta.event_name == \"UpdateTrail\" ||\nevt.Meta.event_name == \"DeleteTrail\" ||\nevt.Meta.event_name == \"StartLogging\" ||\nevt.Meta.event_name == \"StopLogging\"\n)\n",
  "evt.Meta.log_type == 'aws-cloudtrail' &&\n(\nevt.Meta.event_name == \"CreateVpc\" ||\nevt.Meta.event_name == \"DeleteVpc\" ||\nevt.Meta.event_name == \"ModifyVpcAttribute\" ||\nevt.Meta.event_name == \"AcceptVpcPeeringConnection\" ||\nevt.Meta.event_name == \"CreateVpcPeeringConnection\" ||\nevt.Meta.event_name == \"DeleteVpcPeeringConnection\" ||\nevt.Meta.event_name == \"RejectVpcPeeringConnection\" ||\nevt.Meta.event_name == \"AttachClassicLinkVpc\" ||\nevt.Meta.event_name == \"DetachClassicLinkVpc\" ||\nevt.Meta.event_name == \"DisableVpcClassicLink\" ||\nevt.Meta.event_name == \"EnableVpcClassicLink\"\n)\n",
  "evt.Meta.log_type == 'aws-cloudtrail' &&\n(evt.Meta.event_name == 'ConsoleLogin' || evt.Meta.event_name == 'GetSessionToken' || evt.Meta.event_name == 'GetFederationToken') &&\nevt.Unmarshaled.cloudtrail.responseElements?.ConsoleLogin == 'Success' &&\n(\n (evt.Time.Hour() >= 18 || evt.Time.Hour() < 6) || \n (evt.Time.Weekday().String() == 'Saturday' || evt.Time.Weekday().String() == 'Sunday')\n)\n",
  "evt.Meta.log_type == 'aws-cloudtrail' &&\nevt.Meta.event_name == \"ConsoleLogin\" &&\nevt.Unmarshaled.cloudtrail.additionalEventData.MFAUsed != \"Yes\" &&\nevt.Unmarshaled.cloudtrail.userIdentity.type == \"IAMUser\" &&\nevt.Unmarshaled.cloudtrail.responseElements.ConsoleLogin == \"Success\"\n",
  "evt.Meta.log_type == 'aws-cloudtrail' &&\nevt.Unmarshaled.cloudtrail.eventSource == \"kms.amazonaws.com\" &&\n(evt.Meta.event_name == \"DisableKey\" || evt.Meta.event_name == \"ScheduleKeyDeletion\")\n",
  "evt.Meta.log_type == 'aws-cloudtrail' &&\nevt.Unmarshaled.cloudtrail.eventSource == \"s3.amazonaws.com\" &&\n(\n evt.Meta.event_name == \"PutBucketAcl\" ||\n evt.Meta.event_name == \"PutBucketPolicy\" ||\n evt.Meta.event_name == \"PutBucketCors\" ||\n evt.Meta.event_name == \"PutBucketLifecycle\" ||\n evt.Meta.event_name == \"PutBucketReplication\" ||\n evt.Meta.event_name == \"DeleteBucketPolicy\" ||\n evt.Meta.event_name == \"DeleteBucketCors\" ||\n evt.Meta.event_name == \"DeleteBucketLifecycle\" ||\n evt.Meta.event_name == \"DeleteBucketReplication\"\n)\n",
  "evt.Meta.log_type == 'aws-cloudtrail' &&\nevt.Unmarshaled.cloudtrail.userIdentity.type == \"Root\" &&\nevt.Unmarshaled.cloudtrail.userIdentity.invokedBy == nil &&\nevt.Unmarshaled.cloudtrail.eventType != \"AwsServiceEvent\"\n",
  "evt.Meta.log_type == 'aws-cloudtrail' && \nevt.Meta.event_name == \"ConsoleLogin\" && \nevt.Unmarshaled.cloudtrail.errorMessage == \"Failed authentication\"\n",
  "evt.Meta.log_type == 'aws-cloudtrail' && \nevt.Unmarshaled.cloudtrail.eventSource == \"config.amazonaws.com\" &&\n(\n evt.Meta.event_name == \"StopConfigurationRecorder\" ||\n evt.Meta.event_name == \"DeleteDeliveryChannel\" ||\n evt.Meta.event_name == \"PutDeliveryChannel\" ||\n evt.Meta.event_name == \"PutConfigurationRecorder\"\n)\n",
  "evt.Meta.log_type == 'aws-cloudtrail' && (\n  (evt.Meta.event_name == 'ConsoleLogin' && evt.Unmarshaled.cloudtrail.responseElements.ConsoleLogin == 'Failure') || \n  (evt.Meta.event_name == 'GetSessionToken' && evt.Meta.error_code=='AccessDenied') || \n  (evt.Meta.event_name == 'GetFederationToken' && evt.Meta.error_code=='AccessDenied')\n)\n",
  "evt.Meta.log_type == 'baikal_failed_auth'",
  "evt.Meta.log_type == 'bind9_denied'",
  "evt.Meta.log_type == 'cas_failed-auth'",
  "evt.Meta.log_type == 'dovecot_logs' && evt.Meta.dovecot_login_result == 'auth_failed'",
  "evt.Meta.log_type == 'emby_failed_auth'",
  "evt.Meta.log_type == 'endlessh_accept'",
  "evt.Meta.log_type == 'execve'",
  "evt.Meta.log_type == 'execve' && evt.Meta.exe == '/usr/bin/pgrep'",
  "evt.Meta.log_type == 'execve' && evt.Meta.exe in ['/usr/bin/rm', '/bin/rm']",
  "evt.Meta.log_type == 'execve' and ( evt.Meta.exe startsWith \"/tmp/\" or evt.Meta.exe contains \"/.\" )",
  "evt.Meta.log_type == 'exim_failed_auth'",
  "evt.Meta.log_type == 'ftp_failed_auth'",
  "evt.Meta.log_type == 'gitea_failed_auth'",
  "evt.Meta.log_type == 'gitlab_failed_password'",
  "evt.Meta.log_type == 'grafana_failed_auth'",
  "evt.Meta.log_type == 'harbor_failed_auth'",
  "evt.Meta.log_type == 'home-assistant_failed_auth'",
  "evt.Meta.log_type == 'http_access-log' && Upper(evt.Parsed.http_args) contains 'AUTHOR='",
  "evt.Meta.log_type == 'http_access-log' && evt.Meta.http_path startsWith '/apps/login' && evt.Parsed.verb == 'POST' && evt.Meta.http_status == '200'",
  "evt.Meta.log_type == 'http_access-log' && evt.Meta.http_status in ['400','405'] && (evt.Parsed.verb == 'CONNECT' || evt.Parsed.request matches '^http[s]?://')",
  "evt.Meta.log_type == 'http_access-log' && evt.Parsed.file_name == 'wp-login.php' && evt.Parsed.verb == 'POST' && evt.Meta.http_status == '200'",
  "evt.Meta.log_type == 'http_access-log' && evt.Parsed.file_name == 'xmlrpc.php' && evt.Parsed.verb == 'POST'",
  "evt.Meta.log_type == 'http_access-log' && evt.Parsed.file_name contains 'w00tw00t.at.ISC.SANS.DFind'",
  "evt.Meta.log_type == 'http_access-log' && evt.Parsed.file_name contains 'wp-config.php'",
  "evt.Meta.log_type == 'http_access-log' && evt.Parsed.verb == 'POST' && evt.Meta.http_status == '401'",
  "evt.Meta.log_type == 'http_access-log' && evt.Parsed.verb == 'POST' && evt.Meta.http_status == '403'",
  "evt.Meta.log_type == 'http_error-log' && evt.Parsed.program == 'nginx'",
  "evt.Meta.log_type == 'immich_failed_auth'",
  "evt.Meta.log_type == 'iptables_drop' && evt.Meta.service == 'tcp'",
  "evt.Meta.log_type == 'jellyfin_failed_auth'",
  "evt.Meta.log_type == 'jellyseerr_failed_auth'",
  "evt.Meta.log_type == 'k8s-audit' &&\n(\n (\n  evt.Meta.datasource_type == \"k8s-audit\" &&\n  evt.Unmarshaled.k8s_audit.ObjectRef?.Resource == 'pods' &&\n  evt.Unmarshaled.k8s_audit.RequestObject != nil &&\n  evt.Unmarshaled.k8s_audit.RequestObject.spec != nil &&\n  evt.Unmarshaled.k8s_audit.RequestObject.spec.volumes != nil &&\n  any(evt.Unmarshaled.k8s_audit.RequestObject.spec.volumes, { .hostPath != nil && .hostPath.path in [\"/proc\", \"/var/run/docker.sock\", \"/\", \"/etc\", \"/root\", \"/var/run/crio/crio.sock\", \"/home/admin\", \"/var/lib/kubelet\", \"/var/lib/kubelet/pki\", \"/etc/kubernetes\", \"/etc/kubernetes/manifests\"] })\n )\n ||\n (\n  evt.Meta.datasource_type != \"k8s-audit\" &&\n  evt.Unmarshaled.k8s_audit.objectRef?.resource == 'pods' &&\n  evt.Unmarshaled.k8s_audit.requestObject != nil &&\n  evt.Unmarshaled.k8s_audit.requestObject.spec != nil &&\n  evt.Unmarshaled.k8s_audit.requestObject.spec.volumes != nil &&\n  any(evt.Unmarshaled.k8s_audit.requestObject.spec.volumes, { .hostPath != nil && .hostPath.path in [\"/proc\", \"/var/run/docker.sock\", \"/\", \"/etc\", \"/root\", \"/var/run/crio/crio.sock\", \"/home/admin\", \"/var/lib/kubelet\", \"/var/lib/kubelet/pki\", \"/etc/kubernetes\", \"/etc/kubernetes/manifests\"] })\n )\n)\n",
  "evt.Meta.log_type == 'k8s-audit' &&\n(\n (\n  evt.Meta.datasource_type == \"k8s-audit\" &&\n  evt.Unmarshaled.k8s_audit.Verb == 'create' &&\n  evt.Unmarshaled.k8s_audit.ObjectRef?.Resource == 'pods' &&\n  evt.Unmarshaled.k8s_audit.RequestObject != nil &&\n  evt.Unmarshaled.k8s_audit.RequestObject.spec != nil &&\n  any(evt.Unmarshaled.k8s_audit.RequestObject.spec.containers, { .securityContext != nil && .securityContext.privileged == true })\n )\n ||\n (\n  evt.Meta.datasource_type != \"k8s-audit\" &&\n  evt.Unmarshaled.k8s_audit.verb == 'create' &&\n  evt.Unmarshaled.k8s_audit.objectRef?.resource == 'pods' &&\n  evt.Unmarshaled.k8s_audit.requestObject != nil &&\n  evt.Unmarshaled.k8s_audit.requestObject.spec != nil &&\n  any(evt.Unmarshaled.k8s_audit.requestObject.spec.containers, { .securityContext != nil && .securityContext.privileged == true })\n )\n)\n",
  "evt.Meta.log_type == 'k8s-audit' &&\n(\n (evt.Meta.datasource_type == \"k8s-audit\" && evt.Unmarshaled.k8s_audit.ObjectRef?.Resource == 'pods' && evt.Unmarshaled.k8s_audit.ObjectRef?.Subresource == 'exec')\n ||\n (evt.Meta.datasource_type != \"k8s-audit\" && evt.Unmarshaled.k8s_audit.objectRef?.resource == 'pods' && evt.Unmarshaled.k8s_audit.objectRef?.subresource == 'exec')\n)\n",
  "evt.Meta.log_type == 'k8s-audit' &&\n(\n (evt.Meta.datasource_type == \"k8s-audit\" && evt.Unmarshaled.k8s_audit.ObjectRef?.Resource not in [\"healthz\", \"livez\", \"readyz\"]) \n || \n (evt.Meta.datasource_type != \"k8s-audit\" && evt.Unmarshaled.k8s_audit.objectRef?.resource not in [\"healthz\", \"livez\", \"readyz\"])\n)\n&& evt.Meta.user in [\"system:anonymous\", \"system:unauthenticated\"]\n",
  "evt.Meta.log_type == 'k8s-audit' &&\n(\n (evt.Meta.datasource_type == \"k8s-audit\" && evt.Unmarshaled.k8s_audit.Verb == 'create' && evt.Unmarshaled.k8s_audit.ObjectRef?.Resource == 'pods' && evt.Unmarshaled.k8s_audit.RequestObject?.spec?.hostNetwork == true)\n ||\n (evt.Meta.datasource_type != \"k8s-audit\" && evt.Unmarshaled.k8s_audit.verb == 'create' && evt.Unmarshaled.k8s_audit.objectRef?.resource == 'pods' && evt.Unmarshaled.k8s_audit.requestObject?.spec?.hostNetwork == true)\n)\n",
  "evt.Meta.log_type == 'k8s-audit' &&\nevt.Meta.user startsWith \"system:serviceaccount:\" &&\n(\n (evt.Meta.datasource_type == \"k8s-audit\" && evt.Unmarshaled.k8s_audit.Annotations[\"authorization.k8s.io/decision\"] == \"forbid\")\n ||\n (evt.Meta.datasource_type != \"k8s-audit\" && evt.Unmarshaled.k8s_audit.annotations[\"authorization.k8s.io/decision\"] == \"forbid\")\n)\n",
  "evt.Meta.log_type == 'k8s-audit' && \n(\n (evt.Meta.datasource_type == \"k8s-audit\" && evt.Unmarshaled.k8s_audit.ResponseStatus.code in [401, 403])\n ||\n (evt.Meta.datasource_type != \"k8s-audit\" && evt.Unmarshaled.k8s_audit.responseStatus.code in [401, 403])\n)\n",
  "evt.Meta.log_type == 'mail_auth' && evt.Meta.sub_type == 'auth_fail'",
  "evt.Meta.log_type == 'mailu_admin_auth_attempt'",
  "evt.Meta.log_type == 'mariadb_failed_auth'",
  "evt.Meta.log_type == 'meshcentral_failed_auth'",
  "evt.Meta.log_type == 'mikrotik_drop' && evt.Meta.service == 'tcp_udp'",
  "evt.Meta.log_type == 'mikrotik_failed_auth'",
  "evt.Meta.log_type == 'modsecurity' && (evt.Parsed.ruleseverity == 'CRITICAL' || evt.Parsed.ruleseverity == '2')",
  "evt.Meta.log_type == 'mongodb_failed_auth'",
  "evt.Meta.log_type == 'mssql_failed_auth'",
  "evt.Meta.log_type == 'mysql_failed_auth'",
  "evt.Meta.log_type == 'nextcloud_domain_error'",
  "evt.Meta.log_type == 'nextcloud_failed_auth'",
  "evt.Meta.log_type == 'odoo_failed_auth'",
  "evt.Meta.log_type == 'ombi_auth_failed'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'bot protection'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'cross site redirect'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'cross site request forgery'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'cross site scripting'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'error disclosure'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'error limit'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'evasion techniques'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'general'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'http limit violation'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'illegal http method violation'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'ldap injection'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'open redirect'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'path traversal'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'remote code execution'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'request rate limit'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'schema validation'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'sql injection'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'url instead of file'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'vulnerability scanning'",
  "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'xml external entity'",
  "evt.Meta.log_type == 'opnsense-gui-failed-auth'",
  "evt.Meta.log_type == 'paperless_ngx_failed_auth'",
  "evt.Meta.log_type == 'pf' and evt.Parsed.action == 'block'",
  "evt.Meta.log_type == 'pf_drop' && evt.Meta.service == 'tcp_udp'",
  "evt.Meta.log_type == 'pftpd_failed-auth'",
  "evt.Meta.log_type == 'pgsql_failed_auth'",
  "evt.Meta.log_type == 'pterodactly_wings_invalid_format'",
  "evt.Meta.log_type == 'pterodactly_wings_invalid_username_or_password'",
  "evt.Meta.log_type == 'pve_failed-auth'",
  "evt.Meta.log_type == 'redmine_failed_auth'",
  "evt.Meta.log_type == 'smb_failed_auth'",
  "evt.Meta.log_type == 'spam-attempt' && evt.Meta.service == 'exim'",
  "evt.Meta.log_type == 'ssh_bad_keyexchange'",
  "evt.Meta.log_type == 'ssh_failed-auth'",
  "evt.Meta.log_type == 'sshesame_cmd'",
  "evt.Meta.log_type == 'sshesame_input'",
  "evt.Meta.log_type == 'sshesame_login'",
  "evt.Meta.log_type == 'suricata_alert' && evt.Parsed.proto == 'TCP' && evt.Meta.suricata_rule_severity == '1'",
  "evt.Meta.log_type == 'suricata_alert' && evt.Parsed.proto == 'TCP' && evt.Meta.suricata_rule_severity == '2'",
  "evt.Meta.log_type == 'synology-dsm_failed_auth'",
  "evt.Meta.log_type == 'telnet_new_session'",
  "evt.Meta.log_type == 'thehive_failed_auth'",
  "evt.Meta.log_type == 'ts3_fail_auth'",
  "evt.Meta.log_type == 'vaultwarden_failed_auth'",
  "evt.Meta.log_type == 'waf_naxsi-log' && len(evt.Parsed.naxsi_id) > 4",
  "evt.Meta.log_type == 'webmin_failed_auth_wrong_pass'",
  "evt.Meta.log_type == 'windows_failed_auth'",
  "evt.Meta.log_type == 'wireguard_failed_auth'",
  "evt.Meta.log_type == 'zimbra_auth_fail'",
  "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"]\nand \n  (\n    ( Upper(evt.Meta.http_verb) == \"POST\" and\n        Upper(evt.Meta.http_path) matches Upper('^(?P<path>/.*index.php)?.*(?P<file_query>file=.*&lt;/td&gt;&lt;/tr(?P<payload>.*)&gt;)')\n    )\n    or \n    Upper(evt.Parsed.rawrequest) matches Upper('^(?P<verb>POST) (?P<path>/.*index.php)?.*(?P<file_query>file=.*&lt;/td&gt;&lt;/tr(?P<payload>.*)&gt;)')\n  )\n",
  "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"]\nand \n(\n( Upper(evt.Meta.http_verb) == \"POST\" and\nUpper(evt.Meta.http_path) matches Upper('^(?P<path>/.*index.php)?.*(?P<view>view=request|request=log|task=create)+.*(?P<request_query>view=request|request=log|task=create)+.*(?P<task_query>view=request|request=log|task=create)+.*')\n\n)\nor\nUpper(evt.Parsed.rawrequest) matches Upper('^(?P<verb>POST) (?P<path>/.*index.php)?.*(?P<view>view=request|request=log|task=create)+.*(?P<request_query>view=request|request=log|task=create)+.*(?P<task_query>view=request|request=log|task=create)+.*')\n)\n",
  "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"]\nand Upper(evt.Meta.http_verb) == \"GET\"\nand  Upper(evt.Meta.http_path) matches Upper('.*action=.*')\n",
  "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] && RegexpInFile(evt.Parsed.http_user_agent, \"bad_user_agents.regex.txt\")",
  "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and\n  (Upper(evt.Meta.http_path) contains 'CLASS.MODULE.CLASSLOADER.')\n",
  "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and \n  (\n  Upper(evt.Meta.http_path) matches Upper('/tmui/login.jsp/..;/tmui/[^.]+.jsp\\\\?(fileName|command|directoryPath|tabId)=')\n  or\n  Upper(evt.Meta.http_path) matches Upper('/tmui/login.jsp/%2E%2E;/tmui/[^.]+.jsp\\\\?(fileName|command|directoryPath|tabId)=')\n  )\n",
  "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and \n  (Upper(evt.Meta.http_path) contains \"/.%2E/.%2E/\"\n    or\n   Upper(evt.Meta.http_path) contains \"/%2E%2E/%2E%2E\")\n",
  "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and \n  (Upper(evt.Meta.http_path) matches '/PUBLIC/PLUGINS/[^/]+/../[./]+/'\n  or\n  Upper(evt.Meta.http_path) matches '/PUBLIC/PLUGINS/[^/]+/%2E%2E/[%2E/]+/')\n",
  "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and \n  (Upper(evt.Meta.http_path) matches Upper('/dana-na/../dana/html5acc/guacamole/../../../../../../../[^?]+\\\\?/dana/html5acc/guacamole/')\n  or\n  Upper(evt.Meta.http_path) matches Upper('/dana-na/%2E%2E/dana/html5acc/guacamole/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/[^?]+\\\\?/dana/html5acc/guacamole/'))\n",
  "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and \n  Upper(evt.Meta.http_path) contains \"/%%32%65%%32%65/\"\n",
  "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and \n  Upper(evt.Meta.http_path) contains Upper('/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession')\n",
  "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and \n(\n  any(File(\"log4j2_cve_2021_44228.txt\"), { Upper(evt.Meta.http_path) contains Upper(#)})\nor\n  any(File(\"log4j2_cve_2021_44228.txt\"), { Upper(evt.Parsed.http_user_agent) contains Upper(#)})\nor\n  any(File(\"log4j2_cve_2021_44228.txt\"), { Upper(evt.Parsed.http_referer) contains Upper(#)})  \n)\n",
  "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and \nUpper(evt.Meta.http_path) startsWith Upper('/api/v2/cmdb/system/admin/') and Lower(evt.Parsed.http_user_agent) == 'report runner'\n",
  "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and any(File(\"backdoors.txt\"), { evt.Parsed.file_name == #})",
  "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and any(File(\"jira_cve_2021-26086.txt\"), {Upper(evt.Meta.http_path) contains Upper(#)})\n",
  "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and any(File(\"sensitive_data.txt\"), { evt.Parsed.request endsWith #})",
  "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and any(File(\"thinkphp_cve_2018-20062.txt\"), {Upper(evt.Meta.http_path) matches Upper(#)})\n",
  "evt.Meta.log_type in ['authelia_failed_clf_auth', 'authelia_failed_json_auth']",
  "evt.Meta.log_type in ['baikal_failed_auth', 'baikal_failed_auth_no_user']",
  "evt.Meta.log_type in ['bitwarden_failed_auth','bitwarden_failed_auth_2fa']",
  "evt.Meta.log_type in ['gitlab_failed_password', 'gitlab_failed_totp']",
  "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && Lower(QueryUnescape(evt.Meta.http_path)) startsWith Lower('/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=')\n",
  "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && Upper(QueryUnescape(evt.Meta.http_path)) startsWith Upper('/Telerik.Web.UI.WebResource.axd?type=rau')\n",
  "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && Upper(QueryUnescape(evt.Meta.http_path)) startsWith Upper('/catalog-portal/ui/oauth/verify?error=&deviceUdid=${\"freemarker.template.utility.Execute\"?new()(')\n",
  "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && any(File('http_path_traversal.txt'),{evt.Meta.http_path contains #})",
  "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && any(File('sqli_probe_patterns.txt'), {Upper(evt.Parsed.http_args) contains Upper(#)})",
  "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && any(File('xss_probe_patterns.txt'), {Upper(evt.Parsed.http_args) contains Upper(#)})",
  "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && evt.Meta.http_path matches '/ui/vcav-bootstrap/rest/vcav-providers/provider-logo\\\\?url=(file|http)'\n",
  "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && evt.Parsed.static_ressource == 'false' && evt.Parsed.verb in ['GET', 'HEAD']",
  "evt.Meta.log_type in ['nextcloud_failed_auth', 'nextcloud_bruteforce_attempt']",
  "evt.Meta.log_type in ['prowlarr_failed_authentication']",
  "evt.Meta.log_type in ['radarr_failed_authentication']",
  "evt.Meta.log_type in ['sonarr_failed_authentication']",
  "evt.Meta.log_type in ['uptime_kuma_failed_password', 'uptime_kuma_failed_totp']",
  "evt.Meta.log_type in ['vaultwarden_failed_auth', 'vaultwarden_failed_admin_auth', 'vaultwarden_failed_totp']",
  "evt.Meta.log_type_enh == 'spam-attempt' || evt.Meta.log_type == 'postfix' && evt.Meta.action == 'reject'",
  "evt.Meta.metric_name in ['account.login.failed_invalid_user', 'account.login.failed_invalid_password']",
  "evt.Meta.ppid",
  "evt.Meta.service == 'exchange' && evt.Meta.sub_type == 'auth_fail'",
  "evt.Meta.service == 'freeswitch' && evt.Meta.sub_type == 'acl_reject'",
  "evt.Meta.service == 'freeswitch' && evt.Meta.sub_type == 'auth_failure'",
  "evt.Meta.service == 'freeswitch' && evt.Meta.sub_type == 'user_enumeration'",
  "evt.Meta.service == 'http' && evt.Meta.http_status in ['404', '403', '400'] && evt.Parsed.static_ressource == 'false'",
  "evt.Meta.service == 'http' && evt.Meta.log_type in ['http_access-log', 'http_error-log']",
  "evt.Meta.service == 'http' && evt.Meta.sub_type == 'auth_fail'",
  "evt.Meta.service == 'http' && evt.Meta.sub_type == 'litespeed_admin_auth_fail'",
  "evt.Meta.service == 'llng' and evt.Meta.log_type == 'llng_auth_fail'",
  "evt.Meta.service == 'postscreen' && evt.Meta.pregreet == 'PREGREET'",
  "evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1' &&\nevt.Parsed.ParentImage endsWith \"\\\\svchost.exe\" &&\nevt.Parsed.Image endsWith \"\\\\rundll32.exe\" &&\nevt.Parsed.CommandLine contains \"C:\\\\windows\\\\system32\\\\davclnt.dll,DavSetCookie\" &&\nevt.Parsed.CommandLine matches '://\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}' &&\n(not (evt.Parsed.CommandLine contains \"://10.\" ||\n      evt.Parsed.CommandLine contains \"://192.168.\" ||\n      evt.Parsed.CommandLine contains \"://172.16.\" ||\n      evt.Parsed.CommandLine contains \"://172.17.\" ||\n      evt.Parsed.CommandLine contains \"://172.18.\" ||\n      evt.Parsed.CommandLine contains \"://172.19.\" ||\n      evt.Parsed.CommandLine contains \"://172.20.\" ||\n      evt.Parsed.CommandLine contains \"://172.21.\" ||\n      evt.Parsed.CommandLine contains \"://172.22.\" ||\n      evt.Parsed.CommandLine contains \"://172.23.\" ||\n      evt.Parsed.CommandLine contains \"://172.24.\" ||\n      evt.Parsed.CommandLine contains \"://172.25.\" ||\n      evt.Parsed.CommandLine contains \"://172.26.\" ||\n      evt.Parsed.CommandLine contains \"://172.27.\" ||\n      evt.Parsed.CommandLine contains \"://172.28.\" ||\n      evt.Parsed.CommandLine contains \"://172.29.\" ||\n      evt.Parsed.CommandLine contains \"://172.30.\" ||\n      evt.Parsed.CommandLine contains \"://172.31.\" ||\n      evt.Parsed.CommandLine contains \"://127.\" ||\n      evt.Parsed.CommandLine contains \"://169.254.\"))\n",
  "evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1' && \nUpper(evt.Parsed.Image) endsWith 'MSDT.EXE' && \nUpper(evt.Parsed.ParentImage) endsWith 'WINWORD.EXE' &&\n(Upper(evt.Parsed.CommandLine) contains 'PCWDIAGNOSTIC' && Upper(evt.Parsed.CommandLine) contains 'IT_REBROWSEFORFILE' && Upper(evt.Parsed.CommandLine) contains 'IT_BROWSEFORFILE')\n",
  "evt.Meta.service in [\"tcp\", \"udp\"] && evt.Unmarshaled.iptables.OUT == \"\" ? \"iptables_drop\" : \"\"",
  "evt.Meta.source_ip",
  "evt.Meta.sub_type == 'req_limit_exceeded'",
  "evt.Meta.target_user",
  "evt.Meta.user_arn",
  "evt.Overflow.Alert.GetScenario() == 'crowdsecurity/auditd-sus-exec' && all(evt.Overflow.Alert.Events, {.GetMeta('exe') matches '\\\\.nvm\\\\/versions\\\\/node\\\\/v(\\\\d+)\\\\.(\\\\d+)\\\\.(\\\\d+)\\\\/bin\\\\/node$'})",
  "evt.Overflow.Alert.Remediation == true && IsIPV6(evt.Overflow.Alert.Source.IP)",
  "evt.Overflow.Alert.Remediation == true && evt.Overflow.Alert.GetScope() == 'Ip'",
  "evt.Overflow.Alert.Source.IP",
  "evt.Parsed.Channel == 'Application' && evt.Parsed.Source == 'MSSQLSERVER' && evt.Parsed.EventID == '18456'",
  "evt.Parsed.Channel == 'Microsoft-Windows-Sysmon/Operational'",
  "evt.Parsed.Channel == 'Security' && evt.Parsed.EventID == '4625'",
  "evt.Parsed.User",
  "evt.Parsed.action",
  "evt.Parsed.app",
  "evt.Parsed.asterisk_service",
  "evt.Parsed.asterisk_session_id",
  "evt.Parsed.auth_method",
  "evt.Parsed.auth_result",
  "evt.Parsed.cas_client_ip",
  "evt.Parsed.cas_invalid_user",
  "evt.Parsed.client",
  "evt.Parsed.client_ip",
  "evt.Parsed.clientip",
  "evt.Parsed.cri_timestamp",
  "evt.Parsed.date",
  "evt.Parsed.date + ' ' + evt.Parsed.time",
  "evt.Parsed.datetime",
  "evt.Parsed.day + \" \" + evt.Parsed.month + \" \" + evt.Parsed.monthday + \" \" + evt.Parsed.time + \".000000\" + \" \" + evt.Parsed.year",
  "evt.Parsed.db_name",
  "evt.Parsed.dest_ip",
  "evt.Parsed.dest_port",
  "evt.Parsed.dovecot_remote_ip",
  "evt.Parsed.dst_country",
  "evt.Parsed.dst_port",
  "evt.Parsed.elb_status_code",
  "evt.Parsed.email",
  "evt.Parsed.error",
  "evt.Parsed.event_inc_id",
  "evt.Parsed.fastly_timestamp + \".00+\" + evt.Parsed.tz_part1 + \":\" + evt.Parsed.tz_part2",
  "evt.Parsed.file_frag + evt.Parsed.file_ext",
  "evt.Parsed.haproxy_monthday + '/' + evt.Parsed.haproxy_month   + '/' + evt.Parsed.haproxy_year  + ':' +   evt.Parsed.haproxy_hour + ':' + evt.Parsed.haproxy_minute + ':' +  evt.Parsed.haproxy_second[0:2] + ' -0000'",
  "evt.Parsed.http_path",
  "evt.Parsed.http_request",
  "evt.Parsed.http_status_code",
  "evt.Parsed.http_user_agent",
  "evt.Parsed.http_verb",
  "evt.Parsed.invalid_user",
  "evt.Parsed.ipAddress",
  "evt.Parsed.ip_source",
  "evt.Parsed.log_level",
  "evt.Parsed.logsource",
  "evt.Parsed.message contains 'PVEFW-reject' or evt.Parsed.message contains 'DROP' or evt.Parsed.message contains 'REJECT'",
  "evt.Parsed.method",
  "evt.Parsed.naxsi_src_ip",
  "evt.Parsed.pgsql_dbname",
  "evt.Parsed.pgsql_target_user",
  "evt.Parsed.pregreet",
  "evt.Parsed.program == \"gotify\"",
  "evt.Parsed.program == \"suricata-evelogs\" && JsonExtract(evt.Parsed.message, \"event_type\") == \"alert\"\n",
  "evt.Parsed.program == \"zoneminder\"",
  "evt.Parsed.program == 'Prowlarr'",
  "evt.Parsed.program == 'Radarr'",
  "evt.Parsed.program == 'adguardhome'",
  "evt.Parsed.program == 'apache-guacamole'",
  "evt.Parsed.program == 'asterisk'",
  "evt.Parsed.program == 'audit'",
  "evt.Parsed.program == 'auditd'",
  "evt.Parsed.program == 'authelia'",
  "evt.Parsed.program == 'aws-cloudtrail'",
  "evt.Parsed.program == 'bitwarden'",
  "evt.Parsed.program == 'cas'",
  "evt.Parsed.program == 'cowrie'",
  "evt.Parsed.program == 'cpanel'",
  "evt.Parsed.program == 'dovecot'",
  "evt.Parsed.program == 'dropbear'",
  "evt.Parsed.program == 'emby'",
  "evt.Parsed.program == 'endlessh'",
  "evt.Parsed.program == 'exchange-imap'",
  "evt.Parsed.program == 'exchange-pop'",
  "evt.Parsed.program == 'exchange-smtp'",
  "evt.Parsed.program == 'exim'",
  "evt.Parsed.program == 'filterlog' or evt.Parsed.message matches '^filterlog:'",
  "evt.Parsed.program == 'gitea'",
  "evt.Parsed.program == 'grafana'",
  "evt.Parsed.program == 'harbor'",
  "evt.Parsed.program == 'home-assistant' or evt.Parsed.program endsWith 'homeassistant'",
  "evt.Parsed.program == 'iis'",
  "evt.Parsed.program == 'immich'",
  "evt.Parsed.program == 'jellyfin'",
  "evt.Parsed.program == 'jellyseerr'",
  "evt.Parsed.program == 'k8s-audit'",
  "evt.Parsed.program == 'kernel' and evt.Parsed.message contains 'IN=' and not (evt.Parsed.message contains 'ACCEPT')",
  "evt.Parsed.program == 'kernel' and evt.Parsed.message contains 'wireguard:'",
  "evt.Parsed.program == 'keycloak'",
  "evt.Parsed.program == 'laurel'",
  "evt.Parsed.program == 'litespeed'",
  "evt.Parsed.program == 'magento-extension'",
  "evt.Parsed.program == 'mailu-admin'",
  "evt.Parsed.program == 'meshcentral'",
  "evt.Parsed.program == 'mikrotik'",
  "evt.Parsed.program == 'modsecurity'",
  "evt.Parsed.program == 'mssql'",
  "evt.Parsed.program == 'mysql'",
  "evt.Parsed.program == 'odoo'",
  "evt.Parsed.program == 'ombi'",
  "evt.Parsed.program == 'openappsec' && JsonExtract(evt.Parsed.message, 'eventAudience') == 'Security' && Lower(JsonExtract(evt.Parsed.message, 'eventSeverity')) in ['critical', 'high'] && Lower(JsonExtract(evt.Parsed.message, 'eventData.practiceSubType')) in ['web application','web api']",
  "evt.Parsed.program == 'palo-alto-threat'",
  "evt.Parsed.program == 'pkexec'",
  "evt.Parsed.program == 'postgres'",
  "evt.Parsed.program == 'proftpd'",
  "evt.Parsed.program == 'pterodactyl'",
  "evt.Parsed.program == 'pure-ftpd'",
  "evt.Parsed.program == 'pvedaemon'",
  "evt.Parsed.program == 'redmine'",
  "evt.Parsed.program == 'smb'",
  "evt.Parsed.program == 'sshd'",
  "evt.Parsed.program == 'sshesame'",
  "evt.Parsed.program == 'sudo'",
  "evt.Parsed.program == 'suricata-fastlogs'",
  "evt.Parsed.program == 'tcpdump'",
  "evt.Parsed.program == 'thehive'",
  "evt.Parsed.program == 'ts3'",
  "evt.Parsed.program == 'vsftpd'",
  "evt.Parsed.program == 'windows-firewall' and evt.Parsed.message contains ' DROP TCP ' and evt.Parsed.message contains ' RECEIVE'",
  "evt.Parsed.program in ['LLNG','lemonldap-ng']",
  "evt.Parsed.program in ['mono', 'Sonarr']",
  "evt.Parsed.program in ['postfix/postscreen', 'haproxy/postscreen']",
  "evt.Parsed.program in ['postfix/smtpd','postfix/smtps/smtpd','postfix/submission/smtpd', 'postfix/smtps-haproxy/smtpd', 'postfix/submission-haproxy/smtpd']",
  "evt.Parsed.program matches 'synoscgi_SYNO.API.Auth_[1-9]([0-9])?_login'",
  "evt.Parsed.program startsWith 'apache2'",
  "evt.Parsed.program startsWith 'caddy'",
  "evt.Parsed.program startsWith 'freeswitch'",
  "evt.Parsed.program startsWith 'haproxy'",
  "evt.Parsed.program startsWith 'kasm'",
  "evt.Parsed.program startsWith 'mariadb'",
  "evt.Parsed.program startsWith 'nginx'",
  "evt.Parsed.program startsWith 'nginx-proxy-manager'",
  "evt.Parsed.program startsWith 'traefik'",
  "evt.Parsed.program startsWith 'zimbra'",
  "evt.Parsed.rbl_url",
  "evt.Parsed.remote_addr",
  "evt.Parsed.remote_host",
  "evt.Parsed.remote_ip",
  "evt.Parsed.remote_user",
  "evt.Parsed.request",
  "evt.Parsed.request_creation_time",
  "evt.Parsed.response",
  "evt.Parsed.rule",
  "evt.Parsed.rule_id",
  "evt.Parsed.ruledata",
  "evt.Parsed.ruleid",
  "evt.Parsed.rulemessage",
  "evt.Parsed.severity",
  "evt.Parsed.smtp_message",
  "evt.Parsed.source_dns",
  "evt.Parsed.source_helo",
  "evt.Parsed.source_ip",
  "evt.Parsed.source_rdns",
  "evt.Parsed.source_user",
  "evt.Parsed.sourcehost",
  "evt.Parsed.src_country",
  "evt.Parsed.src_ip",
  "evt.Parsed.sshd_client_ip",
  "evt.Parsed.sshd_invalid_user",
  "evt.Parsed.sshesame_cmd",
  "evt.Parsed.sshesame_input",
  "evt.Parsed.sshesame_user",
  "evt.Parsed.status",
  "evt.Parsed.suricata_rule_severity",
  "evt.Parsed.syslog_timestamp",
  "evt.Parsed.target_fqdn",
  "evt.Parsed.target_ip",
  "evt.Parsed.target_port",
  "evt.Parsed.target_uri",
  "evt.Parsed.target_user",
  "evt.Parsed.tcpflags contains 'S' ? 'true' : 'false'",
  "evt.Parsed.telnet_session",
  "evt.Parsed.threat_id",
  "evt.Parsed.time",
  "evt.Parsed.time + 'Z'",
  "evt.Parsed.time_local",
  "evt.Parsed.timestamp",
  "evt.Parsed.timestamp + \"Z\"",
  "evt.Parsed.timestamp8601",
  "evt.Parsed.traefik_router_name",
  "evt.Parsed.unix_epoch",
  "evt.Parsed.user",
  "evt.Parsed.user_agent",
  "evt.Parsed.username",
  "evt.Parsed.verb",
  "evt.Parsed.year+ \"/\" + evt.Parsed.month + \"/\" + evt.Parsed.day + \" \" + evt.Parsed.time",
  "evt.StrTime",
  "evt.StrTime != ''",
  "evt.Unmarshaled.auditd.auid",
  "evt.Unmarshaled.auditd.exe",
  "evt.Unmarshaled.auditd.msg",
  "evt.Unmarshaled.auditd.ppid",
  "evt.Unmarshaled.auditd.tty",
  "evt.Unmarshaled.auditd.uid",
  "evt.Unmarshaled.cloudtrail.awsRegion",
  "evt.Unmarshaled.cloudtrail.errorCode",
  "evt.Unmarshaled.cloudtrail.eventID",
  "evt.Unmarshaled.cloudtrail.eventName",
  "evt.Unmarshaled.cloudtrail.eventSource",
  "evt.Unmarshaled.cloudtrail.eventTime",
  "evt.Unmarshaled.cloudtrail.userAgent",
  "evt.Unmarshaled.cloudtrail.userIdentity.accountId",
  "evt.Unmarshaled.cloudtrail.userIdentity.type",
  "evt.Unmarshaled.cloudtrail.userIdentity?.arn ?? evt.Unmarshaled.cloudtrail.userIdentity.userName\n",
  "evt.Unmarshaled.iptables.CODE",
  "evt.Unmarshaled.iptables.DPT",
  "evt.Unmarshaled.iptables.DST",
  "evt.Unmarshaled.iptables.IN",
  "evt.Unmarshaled.iptables.LEN",
  "evt.Unmarshaled.iptables.PROTO",
  "evt.Unmarshaled.iptables.SPT",
  "evt.Unmarshaled.iptables.SRC",
  "evt.Unmarshaled.iptables.TYPE",
  "evt.Unmarshaled.k8s_audit.ObjectRef?.Name",
  "evt.Unmarshaled.k8s_audit.ObjectRef?.Namespace",
  "evt.Unmarshaled.k8s_audit.RequestObject?.kind",
  "evt.Unmarshaled.k8s_audit.RequestReceivedTimestamp",
  "evt.Unmarshaled.k8s_audit.SourceIPs[0]",
  "evt.Unmarshaled.k8s_audit.User.username",
  "evt.Unmarshaled.k8s_audit.objectRef?.name",
  "evt.Unmarshaled.k8s_audit.objectRef?.namespace",
  "evt.Unmarshaled.k8s_audit.requestObject?.kind",
  "evt.Unmarshaled.k8s_audit.requestReceivedTimestamp",
  "evt.Unmarshaled.k8s_audit.sourceIPs[0]",
  "evt.Unmarshaled.k8s_audit.user.username",
  "evt.Unmarshaled.laurel.ID",
  "evt.Unmarshaled.laurel.SYSCALL.PPID.exe",
  "evt.Unmarshaled.laurel.SYSCALL.SYSCALL",
  "evt.Unmarshaled.laurel.SYSCALL.exe",
  "evt.Unmarshaled.laurel.SYSCALL.tty",
  "evt.Unmarshaled.traefik.ClientHost",
  "evt.Unmarshaled.traefik.DownstreamContentSize != nil ? int(evt.Unmarshaled.traefik.DownstreamContentSize) : nil",
  "evt.Unmarshaled.traefik.RequestAddr",
  "evt.Unmarshaled.traefik.RequestMethod",
  "evt.Unmarshaled.traefik.RequestPath",
  "evt.Unmarshaled.traefik.RouterName",
  "evt.Unmarshaled.traefik.ServiceAddr != nil ? Split(evt.Unmarshaled.traefik.ServiceAddr, ':')[0] : nil",
  "evt.Unmarshaled.traefik.time",
  "evt.Unmarshaled.traefik[\"request_User-Agent\"]",
  "filter(JsonExtractSlice(evt.Parsed.message, \"params\"), {.key == 'user' && .value.login != ''})[0]['value']['login']",
  "int(evt.Unmarshaled.laurel.SYSCALL.auid)",
  "int(evt.Unmarshaled.laurel.SYSCALL.ppid)",
  "int(evt.Unmarshaled.laurel.SYSCALL.uid)",
  "int(evt.Unmarshaled.traefik.DownstreamStatus)",
  "int(evt.Unmarshaled.traefik.Duration)",
  "len(evt.Parsed.http_args)"
]