config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_LINUX and 
 (action_file_name in ("*/11111.tar", "*/aacore.sh", "*/appcheck.sh", "*/autoins", "*/BarracudaMailService", "*/etc/cron.daily/core_check.sh", "*/etc/cron.daily/core.sh", "*/etc/cron.hourly/aacore.sh", "*/etc/cron.hourly/appcheck.sh", "*/etc/cron.hourly/core.sh", "*/get_fs_info.pl", "*/imgdata.jpg", "*/install_att_v2.tar", "*/install_bvp74_auth.tar", "*/install_helo.tar", "*/install_reuse.tar", "*/intent_helo", "*/intent_reuse", "*/intentbas", "*/mod_attachment.lua", "*/mod_content.lua", "*/mod_require_helo.lua", "*/mod_rtf", "*/mod_sender.lua", "*/mod_udp.so", "*/nfsd_stub.ko", "*/resize_reisertab", "*/resize_risertab", "*/resize2fstab", "*/rverify", "*/saslautchd", "*/sendscd", "*/snapshot.tar", "*/tmp/p", "*/tmp/p7", "*/tmp/t", "*/update_v2.sh", "*/update_v31.sh", "*/update_v35.sh", "*/update_version")))