sourceeventrule

1. sysmon1 explorer.exe started chrome.exe pass
2. wazuh5715 sshd: accepted publickey for deploy pass
3. zeekdns query github.com A pass
4. sysmon1 winword.exe started powershell.exe -enc SQBFAFgA pass match
5. cloudtrailauth ConsoleLogin success, MFA used pass
6. suricataflow 10.0.4.12 to 10.0.4.1:53 udp pass