[brandMonitoring_lookup]
filename = brand_monitoring.csv
min_matches=1
match_type = WILDCARD(domain)
default_match=false

[prohibitedProcesses_lookup]
filename = prohibited_processes.csv

[domains]
filename = domains.csv

[lookup_uncommon_processes_default]
filename = uncommon_processes_default.csv
match_type = WILDCARD(process)
case_sensitive_match = false

[lookup_uncommon_processes_local]
filename = uncommon_processes_local.csv
match_type = WILDCARD(process)
case_sensitive_match = false

[dynamic_dns_providers_default]
filename = dynamic_dns_providers_default.csv
match_type = WILDCARD(dynamic_dns_domains)
case_sensitive_match = false

[dynamic_dns_providers_local]
filename = dynamic_dns_providers_local.csv
match_type = WILDCARD(dynamic_dns_domains)
case_sensitive_match = false

[isWindowsSystemFile_lookup]
filename = system32_executables.csv
min_matches=1
default_match=false

[isSuspiciousFileExtension_lookup]
filename = suspicious_email_attachments.csv
match_type = WILDCARD(file_name)

[lookup_rare_process_whitelist_default]
filename = rare_process_whitelist_default.csv
match_type = WILDCARD(process)
min_matches=1
default_match=false
case_sensitive_match = false

[lookup_rare_process_whitelist_local]
filename = rare_process_whitelist_local.csv
match_type = WILDCARD(process)
min_matches=1
default_match=false
case_sensitive_match = false

[escu_search_id_lookup]
filename = escu_search_id.csv

[csc_lookup]
filename = csc_lookup.csv
min_matches=1

[ransomware_extensions_lookup]
filename = ransomware_extensions.csv
min_matches=1
default_match=false

[ransomware_notes_lookup]
filename = ransomware_notes.csv
min_matches=1
default_match=false
match_type = WILDCARD(ransomware_notes)

[prohibited_apps_launching_cmd]
filename = prohibited_apps_launching_cmd.csv
FIELDS = prohibited_applications
match_type = WILDCARD(prohibited_applications)



[previously_seen_aws_regions]
filename = previously_seen_aws_regions.csv
min_matches=1
default_match=false

[security_services_lookup]
filename = security_services.csv
min_matches=1
match_type = WILDCARD(service)
default_match=false

[api_call_by_user_baseline]
filename = api_call_by_user_baseline.csv

[previously_seen_ec2_modifications_by_user]
filename = previously_seen_ec2_modifications_by_user.csv

[previously_seen_api_calls_from_user_roles]
filename = previously_seen_api_calls_from_user_roles.csv

[previously_seen_aws_cross_account_activity]
filename = previously_seen_aws_cross_account_activity.csv

[previously_seen_cmd_line_arguments]
filename = previously_seen_cmd_line_arguments.csv

[baseline_blocked_outbound_connections]
filename = baseline_blocked_outbound_connections.csv

[security_group_activity_baseline]
filename = security_group_activity_baseline.csv

[network_acl_activity_baseline]
filename = network_acl_activity_baseline.csv

[aws_service_accounts]
filename = aws_service_accounts.csv

[suspicious_writes_lookup]
filename = suspicious_files.csv
min_matches=1
default_match=false
match_type = WILDCARD(file)

[previously_seen_S3_access_from_remote_ip]
filename = previously_seen_S3_access_from_remote_ip.csv

[previously_seen_running_windows_services]
filename = previously_seen_running_windows_services.csv

[s3_deletion_baseline]
filename = s3_deletion_baseline.csv

[legit_domains]
filename= legit_domains.csv