securityonion/salt/elasticfleet/files/integrations/grid-nodes_heavy/system-grid-nodes.json

{
  "policy_id": "so-grid-nodes_heavy",
  "package": {
    "name": "system",
    "version": ""
  },
  "name": "system-grid-nodes_heavy",
  "namespace": "default",
  "inputs": {
    "system-logfile": {
      "enabled": true,
      "streams": {
        "system.auth": {
          "enabled": true,
          "vars": {
            "paths": [
              "/var/log/auth.log*",
              "/var/log/secure*"
            ],
            "tags": [
              "so-grid-node"
            ]
          }
        },
        "system.syslog": {
          "enabled": true,
          "vars": {
            "paths": [
              "/var/log/messages*",
              "/var/log/syslog*"
            ],
            "tags": [
              "so-grid-node"
            ]
          }
        }
      }
    },
    "system-winlog": {
      "enabled": false
    },
    "system-system/metrics": {
      "enabled": false
    }
  },
  "force": true
}