config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_file_name in ("*\Andrew.dmp", "*\Coredump.dmp", "*\lsass.dmp", "*\lsass.rar", "*\lsass.zip", "*\NotLSASS.zip", "*\PPLBlade.dmp", "*\rustive.dmp")) or 
 (action_file_name in ("*\lsass_2*", "*\lsassdmp*", "*\lsassdump*")) or 
 (action_file_name contains "\lsass" and 
 action_file_name contains ".dmp") or 
 (action_file_name contains "SQLDmpr" and 
 action_file_name contains ".mdmp") or 
 ((action_file_name in ("*\nanodump*", "*\proc_*")) and 
 action_file_name contains ".dmp")))