Default register agent config

<localfile>
	<location>Microsoft-Windows-Windows Defender/Operational</location>
	<log_format>eventchannel</log_format>
</localfile>

<syscheck>
	<directories realtime="yes">C:\Users\*\Desktop</directories>
	<directories realtime="yes">C:\Users\*\Downloads</directories>
	<directories realtime="yes">C:\Users\*\Documents</directories>
	<directories realtime="yes">%PROGRAMDATA%\Microsoft\Windows\Start Menu\Programs\Startup</directories>
</syscheck>

<localfile>
	<log_format>command</log_format>
	<command>Powershell -c "Get-Volume -DriveLetter C | Select-Object -Property @{'Name' = '% Free'; Expression = {'{0:P}' -f ($_.SizeRemaining / $_.Size)}}"</command>
	<alias>check_win_disk_space</alias>
	<frequency>44000</frequency>
</localfile>

<!--need to have a file go with this-->
<wodle name="command">
    <disabled>no</disabled>
    <tag>tasklist</tag>
    <command>PowerShell.exe C:\tasklist.bat</command>
    <interval>30m</interval>
    <run_on_start>yes</run_on_start>
    <timeout>10</timeout>
  </wodle>

Last updated