elasticfleet:
  enabled: False
  config:
    server:
      custom_fqdn: []
      enable_auto_configuration: True
      endpoints_enrollment: ''
      es_token: ''
      grid_enrollment: ''
  logging:
    zeek:
      excluded:
        - broker
        - capture_loss
        - cluster
        - ecat_arp_info
        - known_hosts
        - known_services
        - loaded_scripts
        - ntp
        - ocsp
        - packet_filter
        - reporter
        - stats
        - stderr
        - stdout
  packages:
    - aws
    - azure
    - cloudflare
    - elasticsearch
    - endpoint
    - fleet_server
    - fim
    - github
    - google_workspace
    - log
    - osquery_manager
    - redis
    - system
    - tcp
    - udp
    - windows
    - 1password