Documentation

Contents
Contents
Contents
Contents

uberAgent-eventdata-filter-vastlimits-macOS.conf

The following is the uberAgent-eventdata-filter-vastlimits-macOS.conf configuration file that ships with uberAgent. It contains eventdata filter rules for macOS curated by vast limits.

[EventDataFilter]
# Exclude processes whose name is exactly one of the given names.
Action = deny
Sourcetype = Process:ProcessStartup
Query = ProcName in ["AppleQEMUGuestAgent", "mdworker_shared", "sleep"]

Leave a Reply

Your email address will not be published. Required fields are marked *