{
  "schema_version": 3,
  "network_modules": [
    "ws2_32.dll",
    "wininet.dll",
    "winhttp.dll",
    "dnsapi.dll",
    "iphlpapi.dll"
  ],
  "dotnet_modules": [
    "clr.dll",
    "coreclr.dll",
    "mscoree.dll",
    "System.Management.Automation.dll"
  ],
  "sensitive_modules": [],
  "module_integrity_allowlist": [
    "ntdll.dll",
    "kernel32.dll",
    "kernelbase.dll",
    "clr.dll",
    "clrjit.dll",
    "system.ni.dll",
    "mscorlib.ni.dll",
    "CallstackMonitor.dll"
  ],
  "alert_on_unbacked_executable": true,
  "alert_on_backed_modified": true,
  "dump_suspicious_regions": true,
  "analyze_dumps": true,
  "carve_embedded_pe": true,
  "module_integrity_enabled": true,
  "enable_sleep_hooks": true,
  "enable_msgwait_hook": true,
  "enable_wait_object_hooks": false,
  "enable_thread_start_hooks": false,
  "enable_threadpool_hooks": false,
  "experimental_hooks": false,
  "memory_api_hooks": false,
  "unwind_integrity": true,
  "unwind_table_hooks": false,
  "origin_trace": false,
  "register_trace": false,
  "follow_remote": false,
  "net_reset": false,
  "etw_telemetry": false,
  "ldr_integrity": false,
  "dispatch_trace": false,
  "threadpool_chain_trace": false,
  "stack_audit": false,
  "memory_audit": false,
  "byoud_trace": false,
  "shadow_stack": false,
  "network_use_trace": false,
  "callsite_validation": true,
  "alert_on_unwind_tamper": true,
  "correlation_window_ms": 5000,
  "max_dump_bytes": 16777216,
  "long_sleep_ms": 1000
}