splunk

The generic Windows audit log config lacks many event ids, e.g.

• registry events
• driver load service addition events, System/7045 and Security/4697
• likely others

Hey,

I see awesome MySQL preset but at case in my company there are still missing some features. We need three things:

• Run in root mode.
• Don't choose database at start because we have multiple db's in single MySQL instance.
• Mount Docker volumes. We use internal cache for seeds and it's saved in Docker volume.

Here's a quick sneak peek what I'm talking about in code:
https://g

What would you like to be added:
We need to configure the fluentd buffer chunk keys via SCK helm chart.
Buffer chunk keys are explained in fluentd docs: here.
In a nutshell the configuration of a chunk key makes fluentd put only events into one chunk which have the same value for the specified chunk key.

**Why is this ne

On RHEL8 systems, with fapolicyd enabled, sc4s fails with the error:

May 16 17:50:29 ip-172-31-35-51.us-east-2.compute.internal podman[9324]: Error: /usr/bin/runc: error while loading shared libraries: libpthread.so.0: cannot open shared object file: Operation not permitted: OCI permission denied
May 16 17:50:29 ip-172-31-35-51.us-east-2.compute.internal systemd[1]: sc4s.service: Main process

In many environments there is a cost to network traffic used. Allowing compression of the HTTP post to the HEC endpoint could greatly reduce these costs and transport time.