Ted Dorosheff
11/19/2021, 1:48 PMoverrides:
platforms:
windows:
options:
events_expiry: 60
config_refresh: 600
host_identifier: instance
distributed_interval: 60
decorators:
load:
- >-
SELECT COALESCE((select instance_id FROM ec2_instance_metadata),
hostname) as hostname FROM system_info;
file_paths:
windows:
- 'C:\Windows'
- 'C:\Windows\temp'
- 'C:\Windows\system32\Drivers'
- 'C:\Windows\SysWOW64\Drivers'
- 'C:\Windows\system32\GroupPolicy\Machine\Scripts'
- 'C:\Windows\system32\GroupPolicy\User\Scripts'
- 'C:\Windows\system32\Wbem'
- 'C:\Windows\SysWOW64\Wbem'
- 'C:\Windows\system32\WindowsPowerShell'
- 'C:\Windows\SysWOW64\WindowsPowerShell'
- 'C:\Windows\Tasks'
- 'C:\Windows\system32\Tasks'
- 'C:\Windows\AppPatch\Custom%'
users:
- 'C:\users\AppData\Roaming'
- 'C:\users\AppData\Local'
- 'C:\users\AppData\Local\temp'
- 'C:\users\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'
- 'C:\users\AppData\Roaming\Microsoft\Windows\Start Menu\Programs'
- 'C:\Users\Default'
ProgramData:
- 'C:\ProgramData\Microsoft\Windows\Start Menu'
- 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs'
exclude_paths:
windows:
- 'C:\Windows\system32\DriverStore\Temp\%'
- 'C:\Windows\system32\wbem\Performance%'
- 'C:\$WINDOWS.~BT\Sources\%'
- 'C:\Windows\Installer\%'
- 'C:\Windows\System32\Tasks\Adobe Acrobat Update Task%'
- 'C:\Windows\System32\Tasks\Adobe Flash Player Updater%'
- >-
C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask%