The following is the
uberAgent-eventdata-filter-vastlimits-macOS.conf configuration file that ships with uberAgent. It contains eventdata filter rules for macOS curated by vast limits.
[EventDataFilter] # Exclude processes whose name is exactly one of the given names. Action = deny Sourcetype = Process:ProcessStartup Query = ProcName in ["AppleQEMUGuestAgent", "mdworker_shared", "sleep"]