@@ -194,6 +194,28 @@ This parameter will come on each event produced by the process.
194
194
195
195
Available formats Array or List. Consult the note at the end of the section.
196
196
197
+ - #### allowed
198
+
199
+ Array
200
+ {: .label .label-yellow }
201
+ String
202
+ {: .label}
203
+
204
+ Set the allowed strings to trigger events, events in this path will trigger if the file contains any of configured strings.
205
+
206
+ Available formats Array or List. Consult the note at the end of the section.
207
+
208
+ - #### exclude
209
+
210
+ Array
211
+ {: .label .label-yellow }
212
+ String
213
+ {: .label}
214
+
215
+ Set the excluded folders inside the Audit path given. Set a path outside of the Audit parent path will produce unexpected behaviour.
216
+
217
+ Available formats Array or List. Consult the note at the end of the section.
218
+
197
219
- #### labels
198
220
199
221
Array
@@ -253,6 +275,28 @@ This parameter will come on each event produced by the process.
253
275
254
276
Available formats Array or List. Consult the note at the end of the section.
255
277
278
+ - #### allowed
279
+
280
+ Array
281
+ {: .label .label-yellow }
282
+ String
283
+ {: .label}
284
+
285
+ Set the allowed strings to trigger events, events in this path will trigger if the file contains any of configured strings.
286
+
287
+ Available formats Array or List. Consult the note at the end of the section.
288
+
289
+ - #### exclude
290
+
291
+ Array
292
+ {: .label .label-yellow }
293
+ String
294
+ {: .label}
295
+
296
+ Set the excluded folders inside the Monitor path given. Set a path outside of the Monitor parent path will produce unexpected behaviour.
297
+
298
+ Available formats Array or List. Consult the note at the end of the section.
299
+
256
300
- #### labels
257
301
258
302
Array
@@ -292,7 +336,7 @@ This parameter will come on each event produced by the process.
292
336
The supported options are [ debug, info, error and warning] .
293
337
294
338
{: .note }
295
- > The ` ignore ` parameter has two different formats:
339
+ > The ` ignore ` , ` allowed ` and ` exclude ` parameters has two different formats:
296
340
> ```
297
341
> - path: /tmp/dir
298
342
> ignore: [.txt, .tmp]
@@ -348,6 +392,9 @@ monitor:
348
392
labels: [ "Program Files", "windows"]
349
393
- path: C:\Users\
350
394
labels: [ "Users", "windows"]
395
+ allowed: [ ".txt", ".doc"]
396
+ exclude:
397
+ - C:\Users\Temp
351
398
352
399
# App procedure and errors logging
353
400
log:
@@ -378,6 +425,7 @@ audit:
378
425
- path: /tmp
379
426
labels: [ "tmp", "linux"]
380
427
ignore: [ ".swp"]
428
+ allowed: [ ".txt", ".odt" ]
381
429
382
430
# Simple files and folders information
383
431
monitor:
@@ -386,6 +434,7 @@ monitor:
386
434
labels: [ "usr/bin", "linux"]
387
435
- path: /etc
388
436
labels: [ "etc", "linux"]
437
+ exclude: [ "/etc/libvirt/qemu" ]
389
438
390
439
# App procedure and errors logging
391
440
log:
0 commit comments