overrides:
  platforms:
    windows:
      options:
        events_expiry: 60
        config_refresh: 600
        host_identifier: instance
        distributed_interval: 60
    decorators:
      load:
        - >-
          SELECT COALESCE((select instance_id FROM ec2_instance_metadata),
          hostname) as hostname FROM system_info;
    file_paths:
      windows:
        - C:\Windows
        - C:\Windows\temp
        - C:\Windows\system32\Drivers
        - C:\Windows\SysWOW64\Drivers
        - C:\Windows\system32\GroupPolicy\Machine\Scripts
        - C:\Windows\system32\GroupPolicy\User\Scripts
        - C:\Windows\system32\Wbem
        - C:\Windows\SysWOW64\Wbem
        - C:\Windows\system32\WindowsPowerShell
        - C:\Windows\SysWOW64\WindowsPowerShell
        - C:\Windows\Tasks
        - C:\Windows\system32\Tasks
        - C:\Windows\AppPatch\Custom%
      users:
        - C:\users\AppData\Roaming
        - C:\users\AppData\Local
        - C:\users\AppData\Local\temp
        - C:\users\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
        - C:\users\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
        - C:\Users\Default
      ProgramData:
        - C:\ProgramData\Microsoft\Windows\Start Menu
        - C:\ProgramData\Microsoft\Windows\Start Menu\Programs
    exclude_paths:
      windows:
        - C:\Windows\system32\DriverStore\Temp\%
        - C:\Windows\system32\wbem\Performance%
        - C:\$WINDOWS.~BT\Sources\%
        - C:\Windows\Installer\%
        - C:\Windows\System32\Tasks\Adobe Acrobat Update Task%
        - C:\Windows\System32\Tasks\Adobe Flash Player Updater%
        - C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask%