config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_file_name in ("C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\*", "C:\Program Files (x86)\Common Files\Microsoft Shared\Web Server Extensions\*")) and 
 (action_file_name in ("*\15\TEMPLATE\LAYOUTS\*", "*\16\TEMPLATE\LAYOUTS\*")) and 
 (action_file_name in ("*\spinstall.aspx", "*\spinstall*.aspx", "*\debug_dev.js"))))