LearnMode: True

Log.StatisticsLevel: 1

Log.DebugLevel: 2

LogResourceList:
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/attacker_0/logs/'  # don't think these are interesting for analysis
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/auth.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/auth.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/syslog.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/syslog.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/syslog.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/syslog.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/apache2/access.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/apache2/error.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/apache2/error.log.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/apache2/error.log.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/apache2/error.log.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/apache2/other_vhosts_access.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/apache2/other_vhosts_access.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/apache2/other_vhosts_access.log.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/apache2/other_vhosts_access.log.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/apache2/other_vhosts_access.log.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/audit/audit.log'
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/redis/redis.log'  # no interesting data in here
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/redis/redis-server.log'  # no interesting data in here
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/redis/redis-server.log.1'  # no interesting data in here
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/suricata/eve.json'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/cloud_share/logs/suricata/fast.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/auth.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/auth.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/mail.info'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/mail.info.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/mail.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/mail.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/mail.warn'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/mail.warn.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/messages'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/messages.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/syslog'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/syslog.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/syslog.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/syslog.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/syslog.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/user.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/user.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/exim4/mainlog'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/exim4/mainlog.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/exim4/mainlog.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/exim4/mainlog.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/exim4/mainlog.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/horde/horde-access.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/davey_mail/logs/horde/horde-error.log'
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/ext_user_0/logs/sm.log'  # json format not implemented yet
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/ext_user_1/logs/sm.log'  # json format not implemented yet
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/ext_user_2/logs/sm.log'  # json format not implemented yet
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/internal_employee_0/logs/sm.log'  # json format not implemented yet
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/internal_employee_1/logs/sm.log'  # json format not implemented yet
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/internal_employee_2/logs/sm.log'  # json format not implemented yet
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/internal_employee_3/logs/sm.log'  # json format not implemented yet
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/remote_employee_0/logs/sm.log'  # json format not implemented yet
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/remote_employee_1/logs/sm.log'  # json format not implemented yet
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/remote_employee_2/logs/sm.log'  # json format not implemented yet
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-dns/logs/auth.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-dns/logs/auth.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-dns/logs/dnsmasq.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-dns/logs/syslog'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-dns/logs/syslog.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-dns/logs/syslog.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-dns/logs/syslog.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-dns/logs/syslog.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-firewall/logs/auth.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-firewall/logs/auth.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-firewall/logs/dnsmasq.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-firewall/logs/kern.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-firewall/logs/kern.log.1'
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-firewall/logs/shorewall-init.log'  # not implemented as it is not important (firewall config logs)
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-firewall/logs/shorewall-init.log.1'  # not implemented as it is not important (firewall config logs)
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-firewall/logs/syslog.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-firewall/logs/syslog.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-firewall/logs/syslog.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-firewall/logs/syslog.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-firewall/logs/audit/audit.log'
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-firewall/logs/suricata/eve.json'
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-firewall/logs/suricata/fast.log'
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-firewall/logs/suricata/stats.log'  # no interesting data in here
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-firewall/logs/suricata/suricata.log'  # config logs - don't think they are interesting
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/inet-firewall/logs/suricata/suricata-start.log'  # config logs - don't think they are interesting
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/internal_share/logs/auth.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/internal_share/logs/auth.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/internal_share/logs/syslog.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/internal_share/logs/syslog.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/internal_share/logs/syslog.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/internal_share/logs/syslog.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/internal_share/logs/audit/audit.log'
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/internal_share/logs/suricata/eve.json'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/internal_share/logs/suricata/fast.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/auth.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/auth.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/syslog.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/syslog.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/syslog.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/syslog.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/apache2/access.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/apache2/error.log.1'
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/apache2/error.log.2'  # only download in here..
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/apache2/error.log.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/apache2/error.log.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/apache2/intranet.smith.russellmitchell.com-access.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/apache2/intranet.smith.russellmitchell.com-access.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/apache2/intranet.smith.russellmitchell.com-access.log.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/apache2/intranet.smith.russellmitchell.com-access.log.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/apache2/intranet.smith.russellmitchell.com-access.log.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/apache2/intranet.smith.russellmitchell.com-error.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/apache2/intranet.smith.russellmitchell.com-error.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/apache2/intranet.smith.russellmitchell.com-error.log.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/apache2/intranet.smith.russellmitchell.com-error.log.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/apache2/other_vhosts_access.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/audit/audit.log'
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/suricata/eve.json'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/intranet_server/logs/suricata/fast.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/auth.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/auth.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/mail.info'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/mail.info.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/mail.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/mail.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/mail.warn'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/messages'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/messages.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/syslog.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/syslog.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/syslog.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/syslog.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/user.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/user.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/audit/audit.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/exim4/mainlog'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/exim4/mainlog.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/exim4/mainlog.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/exim4/mainlog.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/exim4/mainlog.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/horde/horde-access.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/horde/horde-error.log'
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/suricata/eve.json'
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/suricata/eve.json.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/suricata/fast.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/mail/logs/suricata/fast.log.1'
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/monitoring/logs/logstash'  # skipping these logs for now, because the information can be found from the system logs
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/auth.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/auth.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/mail.info'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/mail.info.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/mail.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/mail.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/mail.warn'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/mail.warn.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/messages'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/messages.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/syslog'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/syslog.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/syslog.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/syslog.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/syslog.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/user.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/user.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/exim4/mainlog'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/exim4/mainlog.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/exim4/mainlog.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/exim4/mainlog.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/exim4/mainlog.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/horde/horde-access.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/morris_mail/logs/horde/horde-error.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/vpn/logs/auth.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/vpn/logs/auth.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/vpn/logs/openvpn.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/vpn/logs/syslog.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/vpn/logs/syslog.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/vpn/logs/syslog.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/vpn/logs/syslog.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/vpn/logs/audit/audit.log'
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/vpn/logs/suricata/eve.json'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/vpn/logs/suricata/fast.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/auth.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/auth.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/syslog.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/syslog.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/syslog.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/syslog.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/access.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/cloud.smith.russellmitchell.com-access.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/cloud.smith.russellmitchell.com-access.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/cloud.smith.russellmitchell.com-access.log.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/cloud.smith.russellmitchell.com-access.log.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/cloud.smith.russellmitchell.com-access.log.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/cloud.smith.russellmitchell.com-error.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/cloud.smith.russellmitchell.com-error.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/error.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/error.log.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/error.log.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/error.log.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/mail.smith.russellmitchell.com-access.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/mail.smith.russellmitchell.com-access.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/mail.smith.russellmitchell.com-access.log.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/mail.smith.russellmitchell.com-access.log.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/mail.smith.russellmitchell.com-access.log.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/mail.smith.russellmitchell.com-error.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/other_vhosts_access.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/proxy-access.log'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/proxy-access.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/proxy-access.log.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/proxy-access.log.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/proxy-access.log.4'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/proxy-error.log.1'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/proxy-error.log.2'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/apache2/proxy-error.log.3'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/audit/audit.log'
  #- 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/suricata/eve.json'
  - 'file:///home/user/Downloads/AIT-LDS2/russellmitchell/gather/webserver/logs/suricata/fast.log'

#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/cloud_share/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/cloud_share/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/cloud_share/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/cloud_share/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/cloud_share/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/cloud_share/logs/apache2/access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/cloud_share/logs/apache2/error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/cloud_share/logs/apache2/error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/cloud_share/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/cloud_share/logs/apache2/other_vhosts_access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/cloud_share/logs/apache2/other_vhosts_access.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/cloud_share/logs/apache2/other_vhosts_access.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/cloud_share/logs/apache2/other_vhosts_access.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/cloud_share/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/cloud_share/logs/redis/redis.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/cloud_share/logs/redis/redis-server.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/cloud_share/logs/redis/redis-server.log.1'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/cloud_share/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/cloud_share/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/hayes_mail/logs/horde/horde-error.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/ext_user_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/ext_user_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/ext_user_2/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/internal_employee_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/internal_employee_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/internal_employee_2/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/internal_employee_3/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/remote_employee_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/remote_employee_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/remote_employee_2/logs/sm.log'  # json format not implemented yet
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-dns/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-dns/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-dns/logs/dnsmasq.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-dns/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-dns/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-dns/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-dns/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-firewall/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-firewall/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-firewall/logs/dnsmasq.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-firewall/logs/kern.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-firewall/logs/kern.log.1'
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-firewall/logs/shorewall-init.log'  # not implemented as it is not important (firewall config logs)
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-firewall/logs/shorewall-init.log.1'  # not implemented as it is not important (firewall config logs)
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-firewall/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-firewall/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-firewall/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-firewall/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-firewall/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-firewall/logs/suricata/eve.json'
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-firewall/logs/suricata/fast.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-firewall/logs/suricata/stats.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-firewall/logs/suricata/suricata.log'  # config logs - don't think they are interesting
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/inet-firewall/logs/suricata/suricata-start.log'  # config logs - don't think they are interesting
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/internal_share/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/internal_share/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/internal_share/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/internal_share/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/internal_share/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/internal_share/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/internal_share/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/internal_share/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/intranet_server/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/intranet_server/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/intranet_server/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/intranet_server/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/intranet_server/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/intranet_server/logs/apache2/access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/intranet_server/logs/apache2/error.log.1'
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/intranet_server/logs/apache2/error.log.2'  # only download in here..
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/intranet_server/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/intranet_server/logs/apache2/intranet.smith.santos.com-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/intranet_server/logs/apache2/intranet.smith.santos.com-access.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/intranet_server/logs/apache2/intranet.smith.santos.com-error.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/intranet_server/logs/apache2/intranet.smith.santos.com-error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/intranet_server/logs/apache2/other_vhosts_access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/intranet_server/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/intranet_server/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/intranet_server/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/audit/audit.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/horde/horde-error.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/suricata/eve.json'
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/suricata/eve.json.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/mail/logs/suricata/fast.log.1'
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/monitoring/logs/logstash'  # skipping these logs for now, because the information can be found from the system logs
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/rogersturnbull_mail/logs/horde/horde-error.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/vpn/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/vpn/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/vpn/logs/openvpn.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/vpn/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/vpn/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/vpn/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/vpn/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/vpn/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/vpn/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/cloud.smith.santos.com-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/cloud.smith.santos.com-access.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/cloud.smith.santos.com-access.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/cloud.smith.santos.com-access.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/cloud.smith.santos.com-error.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/mail.smith.santos.com-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/mail.smith.santos.com-access.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/mail.smith.santos.com-access.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/mail.smith.santos.com-access.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/mail.smith.santos.com-error.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/other_vhosts_access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/proxy-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/proxy-access.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/proxy-access.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/proxy-access.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/apache2/proxy-error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/santos/gather/webserver/logs/suricata/fast.log'

#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/apache2/access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/apache2/error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/apache2/error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/apache2/error.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/apache2/other_vhosts_access.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/apache2/other_vhosts_access.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/apache2/other_vhosts_access.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/apache2/other_vhosts_access.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/redis/redis.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/redis/redis-server.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/redis/redis-server.log.1'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/cloud_share/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/fischer_mail/logs/horde/horde-error.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/ext_user_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/ext_user_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/ext_user_2/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/internal_employee_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/internal_employee_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/internal_employee_2/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/internal_employee_3/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/remote_employee_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/remote_employee_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/remote_employee_2/logs/sm.log'  # json format not implemented yet
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-dns/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-dns/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-dns/logs/dnsmasq.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-dns/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-dns/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-dns/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-dns/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-dns/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-firewall/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-firewall/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-firewall/logs/dnsmasq.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-firewall/logs/kern.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-firewall/logs/kern.log.1'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-firewall/logs/shorewall-init.log'  # not implemented as it is not important (firewall config logs)
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-firewall/logs/shorewall-init.log.1'  # not implemented as it is not important (firewall config logs)
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-firewall/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-firewall/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-firewall/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-firewall/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-firewall/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-firewall/logs/suricata/eve.json'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-firewall/logs/suricata/fast.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-firewall/logs/suricata/stats.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-firewall/logs/suricata/suricata.log'  # config logs - don't think they are interesting
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/inet-firewall/logs/suricata/suricata-start.log'  # config logs - don't think they are interesting
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/internal_share/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/internal_share/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/internal_share/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/internal_share/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/internal_share/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/internal_share/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/internal_share/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/internal_share/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/internal_share/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/intranet_server/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/intranet_server/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/intranet_server/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/intranet_server/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/intranet_server/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/intranet_server/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/intranet_server/logs/apache2/access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/intranet_server/logs/apache2/error.log.1'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/intranet_server/logs/apache2/error.log.2'  # only download in here..
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/intranet_server/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/intranet_server/logs/apache2/error.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/intranet_server/logs/apache2/other_vhosts_access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/intranet_server/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/intranet_server/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/intranet_server/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/audit/audit.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/horde/horde-error.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/suricata/eve.json'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/suricata/eve.json.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/mail/logs/suricata/fast.log.1'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/monitoring/logs/logstash'  # skipping these logs for now, because the information can be found from the system logs
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/sanchez_mail/logs/horde/horde-error.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/vpn/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/vpn/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/vpn/logs/openvpn.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/vpn/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/vpn/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/vpn/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/vpn/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/vpn/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/vpn/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/vpn/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/apache2/access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/apache2/error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/apache2/error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/apache2/error.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/apache2/other_vhosts_access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/apache2/proxy-access.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/apache2/proxy-access.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/apache2/proxy-access.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/apache2/proxy-access.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/apache2/proxy-error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/apache2/proxy-error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/apache2/proxy-error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/webserver/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/khanwood_mail/logs/horde/horde-error.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wheeler/gather/williams_mail/logs/horde/horde-error.log'

#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/apache2/access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/apache2/error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/apache2/error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/apache2/error.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/apache2/other_vhosts_access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/apache2/other_vhosts_access.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/apache2/other_vhosts_access.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/apache2/other_vhosts_access.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/apache2/other_vhosts_access.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/redis/redis.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/redis/redis-server.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/redis/redis-server.log.1'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/cloud_share/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/smith_mail/logs/horde/horde-error.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/ext_user_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/ext_user_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/ext_user_2/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/internal_employee_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/internal_employee_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/internal_employee_2/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/internal_employee_3/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/remote_employee_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/remote_employee_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/remote_employee_2/logs/sm.log'  # json format not implemented yet
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-dns/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-dns/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-dns/logs/dnsmasq.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-dns/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-dns/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-dns/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-dns/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-dns/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-firewall/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-firewall/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-firewall/logs/dnsmasq.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-firewall/logs/kern.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-firewall/logs/kern.log.1'
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-firewall/logs/shorewall-init.log'  # not implemented as it is not important (firewall config logs)
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-firewall/logs/shorewall-init.log.1'  # not implemented as it is not important (firewall config logs)
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-firewall/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-firewall/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-firewall/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-firewall/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-firewall/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-firewall/logs/suricata/eve.json'
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-firewall/logs/suricata/fast.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-firewall/logs/suricata/stats.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-firewall/logs/suricata/suricata.log'  # config logs - don't think they are interesting
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/inet-firewall/logs/suricata/suricata-start.log'  # config logs - don't think they are interesting
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/internal_share/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/internal_share/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/internal_share/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/internal_share/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/internal_share/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/internal_share/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/internal_share/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/internal_share/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/internal_share/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/intranet_server/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/intranet_server/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/intranet_server/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/intranet_server/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/intranet_server/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/intranet_server/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/intranet_server/logs/apache2/access.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/intranet_server/logs/apache2/error.log.1'  # only download in here..
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/intranet_server/logs/apache2/error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/intranet_server/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/intranet_server/logs/apache2/error.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/intranet_server/logs/apache2/other_vhosts_access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/intranet_server/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/intranet_server/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/intranet_server/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/audit/audit.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/horde/horde-error.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/suricata/eve.json'
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/suricata/eve.json.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/mail/logs/suricata/fast.log.1'
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/monitoring/logs/logstash'  # skipping these logs for now, because the information can be found from the system logs
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/taylor_mail/logs/horde/horde-error.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/vpn/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/vpn/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/vpn/logs/openvpn.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/vpn/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/vpn/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/vpn/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/vpn/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/vpn/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/vpn/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/vpn/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/apache2/access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/apache2/error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/apache2/error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/apache2/error.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/apache2/other_vhosts_access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/apache2/proxy-access.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/apache2/proxy-access.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/apache2/proxy-access.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/apache2/proxy-access.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/apache2/proxy-error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/apache2/proxy-error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/apache2/proxy-error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/harrison/gather/webserver/logs/suricata/fast.log'

#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/apache2/access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/apache2/error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/apache2/error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/apache2/error.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/apache2/other_vhosts_access.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/apache2/other_vhosts_access.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/apache2/other_vhosts_access.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/apache2/other_vhosts_access.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/redis/redis.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/redis/redis-server.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/redis/redis-server.log.1'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/cloud_share/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/smith_mail/logs/horde/horde-error.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/ext_user_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/ext_user_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/ext_user_2/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/internal_employee_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/internal_employee_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/internal_employee_2/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/internal_employee_3/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/remote_employee_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/remote_employee_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/remote_employee_2/logs/sm.log'  # json format not implemented yet
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-dns/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-dns/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-dns/logs/dnsmasq.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-dns/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-dns/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-dns/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-dns/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-dns/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-firewall/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-firewall/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-firewall/logs/dnsmasq.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-firewall/logs/kern.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-firewall/logs/kern.log.1'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-firewall/logs/shorewall-init.log'  # not implemented as it is not important (firewall config logs)
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-firewall/logs/shorewall-init.log.1'  # not implemented as it is not important (firewall config logs)
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-firewall/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-firewall/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-firewall/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-firewall/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-firewall/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-firewall/logs/suricata/eve.json'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-firewall/logs/suricata/fast.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-firewall/logs/suricata/stats.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-firewall/logs/suricata/suricata.log'  # config logs - don't think they are interesting
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/inet-firewall/logs/suricata/suricata-start.log'  # config logs - don't think they are interesting
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/internal_share/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/internal_share/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/internal_share/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/internal_share/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/internal_share/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/internal_share/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/internal_share/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/internal_share/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/internal_share/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/intranet_server/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/intranet_server/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/intranet_server/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/intranet_server/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/intranet_server/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/intranet_server/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/intranet_server/logs/apache2/access.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/intranet_server/logs/apache2/error.log.1'  # only download in here..
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/intranet_server/logs/apache2/error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/intranet_server/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/intranet_server/logs/apache2/error.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/intranet_server/logs/apache2/other_vhosts_access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/intranet_server/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/intranet_server/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/intranet_server/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/audit/audit.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/horde/horde-error.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/suricata/eve.json'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/suricata/eve.json.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/mail/logs/suricata/fast.log.1'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/monitoring/logs/logstash'  # skipping these logs for now, because the information can be found from the system logs
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/walker_mail/logs/horde/horde-error.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/vpn/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/vpn/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/vpn/logs/openvpn.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/vpn/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/vpn/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/vpn/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/vpn/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/vpn/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/vpn/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/vpn/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/apache2/access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/apache2/error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/apache2/error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/apache2/error.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/apache2/other_vhosts_access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/apache2/proxy-access.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/apache2/proxy-access.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/apache2/proxy-access.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/apache2/proxy-access.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/apache2/proxy-error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/apache2/proxy-error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/apache2/proxy-error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/webserver/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wardbeck/gather/watkins_mail/logs/horde/horde-error.log'

#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/apache2/access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/apache2/error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/apache2/error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/apache2/error.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/apache2/other_vhosts_access.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/apache2/other_vhosts_access.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/apache2/other_vhosts_access.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/apache2/other_vhosts_access.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/redis/redis.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/redis/redis-server.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/redis/redis-server.log.1'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/cloud_share/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/butcherrowe_mail/logs/horde/horde-error.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/ext_user_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/ext_user_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/ext_user_2/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/internal_employee_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/internal_employee_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/internal_employee_2/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/internal_employee_3/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/remote_employee_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/remote_employee_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/remote_employee_2/logs/sm.log'  # json format not implemented yet
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-dns/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-dns/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-dns/logs/dnsmasq.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-dns/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-dns/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-dns/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-dns/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-dns/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-firewall/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-firewall/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-firewall/logs/dnsmasq.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-firewall/logs/kern.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-firewall/logs/kern.log.1'
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-firewall/logs/shorewall-init.log'  # not implemented as it is not important (firewall config logs)
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-firewall/logs/shorewall-init.log.1'  # not implemented as it is not important (firewall config logs)
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-firewall/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-firewall/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-firewall/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-firewall/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-firewall/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-firewall/logs/suricata/eve.json'
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-firewall/logs/suricata/fast.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-firewall/logs/suricata/stats.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-firewall/logs/suricata/suricata.log'  # config logs - don't think they are interesting
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/inet-firewall/logs/suricata/suricata-start.log'  # config logs - don't think they are interesting
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/internal_share/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/internal_share/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/internal_share/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/internal_share/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/internal_share/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/internal_share/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/internal_share/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/internal_share/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/internal_share/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/intranet_server/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/intranet_server/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/intranet_server/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/intranet_server/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/intranet_server/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/intranet_server/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/intranet_server/logs/apache2/access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/intranet_server/logs/apache2/error.log.1'
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/intranet_server/logs/apache2/error.log.2'  # only download in here..
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/intranet_server/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/intranet_server/logs/apache2/error.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/intranet_server/logs/apache2/other_vhosts_access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/intranet_server/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/intranet_server/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/intranet_server/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/audit/audit.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/horde/horde-error.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/suricata/eve.json'
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/suricata/eve.json.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/mail/logs/suricata/fast.log.1'
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/monitoring/logs/logstash'  # skipping these logs for now, because the information can be found from the system logs
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/collinsbecker_mail/logs/horde/horde-error.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/vpn/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/vpn/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/vpn/logs/openvpn.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/vpn/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/vpn/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/vpn/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/vpn/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/vpn/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/vpn/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/vpn/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/apache2/access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/apache2/error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/apache2/error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/apache2/error.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/apache2/other_vhosts_access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/apache2/proxy-access.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/apache2/proxy-access.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/apache2/proxy-access.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/apache2/proxy-access.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/apache2/proxy-error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/apache2/proxy-error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/apache2/proxy-error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/webserver/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/shaw/gather/smith_mail/logs/horde/horde-error.log'
#
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/apache2/access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/apache2/error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/apache2/error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/apache2/error.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/apache2/other_vhosts_access.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/apache2/other_vhosts_access.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/apache2/other_vhosts_access.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/apache2/other_vhosts_access.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/redis/redis.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/redis/redis-server.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/redis/redis-server.log.1'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/cloud_share/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/lane_mail/logs/horde/horde-error.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/ext_user_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/ext_user_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/ext_user_2/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/internal_employee_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/internal_employee_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/internal_employee_2/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/internal_employee_3/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/remote_employee_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/remote_employee_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/remote_employee_2/logs/sm.log'  # json format not implemented yet
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-dns/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-dns/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-dns/logs/dnsmasq.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-dns/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-dns/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-dns/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-dns/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-dns/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-firewall/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-firewall/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-firewall/logs/dnsmasq.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-firewall/logs/kern.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-firewall/logs/kern.log.1'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-firewall/logs/shorewall-init.log'  # not implemented as it is not important (firewall config logs)
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-firewall/logs/shorewall-init.log.1'  # not implemented as it is not important (firewall config logs)
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-firewall/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-firewall/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-firewall/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-firewall/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-firewall/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-firewall/logs/suricata/eve.json'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-firewall/logs/suricata/fast.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-firewall/logs/suricata/stats.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-firewall/logs/suricata/suricata.log'  # config logs - don't think they are interesting
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/inet-firewall/logs/suricata/suricata-start.log'  # config logs - don't think they are interesting
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/internal_share/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/internal_share/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/internal_share/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/internal_share/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/internal_share/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/internal_share/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/internal_share/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/internal_share/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/internal_share/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/intranet_server/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/intranet_server/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/intranet_server/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/intranet_server/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/intranet_server/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/intranet_server/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/intranet_server/logs/apache2/access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/intranet_server/logs/apache2/error.log.1'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/intranet_server/logs/apache2/error.log.2'  # only download in here..
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/intranet_server/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/intranet_server/logs/apache2/error.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/intranet_server/logs/apache2/other_vhosts_access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/intranet_server/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/intranet_server/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/intranet_server/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/audit/audit.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/horde/horde-error.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/suricata/eve.json'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/suricata/eve.json.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/mail/logs/suricata/fast.log.1'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/monitoring/logs/logstash'  # skipping these logs for now, because the information can be found from the system logs
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/wilsonahmed_mail/logs/horde/horde-error.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/vpn/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/vpn/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/vpn/logs/openvpn.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/vpn/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/vpn/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/vpn/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/vpn/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/vpn/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/vpn/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/vpn/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/apache2/access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/apache2/error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/apache2/error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/apache2/error.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/apache2/other_vhosts_access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/apache2/proxy-access.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/apache2/proxy-access.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/apache2/proxy-access.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/apache2/proxy-access.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/apache2/proxy-error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/apache2/proxy-error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/apache2/proxy-error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/wilson/gather/webserver/logs/suricata/fast.log'
#
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/apache2/access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/apache2/error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/apache2/error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/apache2/error.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/apache2/other_vhosts_access.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/apache2/other_vhosts_access.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/apache2/other_vhosts_access.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/apache2/other_vhosts_access.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/redis/redis.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/redis/redis-server.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/redis/redis-server.log.1'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/cloud_share/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/jonesmorgan_mail/logs/horde/horde-error.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/ext_user_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/ext_user_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/ext_user_2/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/internal_employee_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/internal_employee_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/internal_employee_2/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/internal_employee_3/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/remote_employee_0/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/remote_employee_1/logs/sm.log'  # json format not implemented yet
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/remote_employee_2/logs/sm.log'  # json format not implemented yet
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-dns/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-dns/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-dns/logs/dnsmasq.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-dns/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-dns/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-dns/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-dns/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-dns/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-firewall/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-firewall/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-firewall/logs/dnsmasq.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-firewall/logs/kern.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-firewall/logs/kern.log.1'
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-firewall/logs/shorewall-init.log'  # not implemented as it is not important (firewall config logs)
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-firewall/logs/shorewall-init.log.1'  # not implemented as it is not important (firewall config logs)
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-firewall/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-firewall/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-firewall/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-firewall/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-firewall/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-firewall/logs/suricata/eve.json'
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-firewall/logs/suricata/fast.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-firewall/logs/suricata/stats.log'  # no interesting data in here
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-firewall/logs/suricata/suricata.log'  # config logs - don't think they are interesting
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/inet-firewall/logs/suricata/suricata-start.log'  # config logs - don't think they are interesting
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/internal_share/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/internal_share/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/internal_share/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/internal_share/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/internal_share/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/internal_share/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/internal_share/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/internal_share/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/internal_share/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/intranet_server/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/intranet_server/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/intranet_server/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/intranet_server/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/intranet_server/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/intranet_server/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/intranet_server/logs/apache2/access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/intranet_server/logs/apache2/error.log.1'
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/intranet_server/logs/apache2/error.log.2'  # only download in here..
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/intranet_server/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/intranet_server/logs/apache2/error.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/intranet_server/logs/apache2/other_vhosts_access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/intranet_server/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/intranet_server/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/intranet_server/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/audit/audit.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/horde/horde-error.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/suricata/eve.json'
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/suricata/eve.json.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/mail/logs/suricata/fast.log.1'
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/monitoring/logs/logstash'  # skipping these logs for now, because the information can be found from the system logs
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/miller_mail/logs/horde/horde-error.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/vpn/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/vpn/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/vpn/logs/openvpn.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/vpn/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/vpn/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/vpn/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/vpn/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/vpn/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/vpn/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/vpn/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/apache2/access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/apache2/error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/apache2/error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/apache2/error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/apache2/error.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/apache2/other_vhosts_access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/apache2/proxy-access.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/apache2/proxy-access.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/apache2/proxy-access.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/apache2/proxy-access.log.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/apache2/proxy-error.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/apache2/proxy-error.log.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/apache2/proxy-error.log.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/audit/audit.log'
#  #- 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/suricata/eve.json'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/webserver/logs/suricata/fast.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/taylorcruz_mail/logs/horde/horde-error.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/auth.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/auth.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/mail.info'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/mail.info.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/mail.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/mail.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/mail.warn'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/mail.warn.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/messages'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/messages.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/syslog'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/syslog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/syslog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/syslog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/syslog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/user.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/user.log.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/exim4/mainlog'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/exim4/mainlog.1'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/exim4/mainlog.2'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/exim4/mainlog.3'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/exim4/mainlog.4'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/horde/horde-access.log'
#  - 'file:///home/user/Downloads/AIT-LDS2/fox/gather/whittaker_mail/logs/horde/horde-error.log'

Parser:
  - id: ApacheAccessParsingModel
    type: ApacheAccessParsingModel
    name: 'ApacheAccessParsingModel'

  - id: ApacheErrorParsingModel
    type: ApacheErrorParsingModel
    name: 'ApacheErrorParsingModel'

  - id: AuditdParsingModel
    type: AuditdParsingModel
    name: 'AuditdParsingModel'

  - id: DnsParsingModel
    type: DnsParsingModel
    name: 'DnsParsingModel'

  - id: EximParsingModel
    type: EximParsingModel
    name: 'EximParsingModel'

  - id: SyslogParsingModel
    type: SyslogParsingModel
    name: 'SyslogParsingModel'

  - id: SuricataFastParsingModel
    type: SuricataFastParsingModel
    name: 'SuricataFastParsingModel'

  - id: SuricataEventParsingModel
    type: SuricataEventParsingModel
    name: 'SuricataEventParsingModel'

  - id: OpenVpnParsingModel
    type: OpenVpnParsingModel
    name: 'OpenVpnParsingModel'

  - id: model
    start: True
    type: FirstMatchModelElement
    name: 'model'
    args:
      - ApacheAccessParsingModel
      - ApacheErrorParsingModel
      - AuditdParsingModel
      - DnsParsingModel
      - EximParsingModel
      - SyslogParsingModel
      - SuricataFastParsingModel
      - SuricataEventParsingModel
      - OpenVpnParsingModel





  - id: timestamp
    type: DateTimeModelElement
    name: 'timestamp'
    date_format: '%Y-%m-%dT%H:%M:%S.%f%z'

  - id: _flow_id
    type: DecimalIntegerValueModelElement
    name: '_flow_id'

  - id: _in_iface
    type: AnyByteDataModelElement
    name: '_in_iface'

  - id: event_type
    type: FixedWordlistDataModelElement
    name: 'event_type'
    args:
      - 'dns'
      - 'http'
      - 'fileinfo'
      - 'stats'
      - 'flow'
      - 'alert'
      - 'tls'
      - 'ssh'

  - id: ip_ipv4
    type: IpAddressDataModelElement
    name: 'ipv4'

  - id: ip_ipv6
    type: VariableByteDataModelElement
    name: 'ipv6'
    args: 'abcdefABCDEF0123456789:'

  - id: _src_ip
    type: FirstMatchModelElement
    name: '_src_ip'
    args:
      - ip_ipv4
      - ip_ipv6

  - id: _src_port
    type: DecimalIntegerValueModelElement
    name: '_src_port'

  - id: _dest_ip
    type: FirstMatchModelElement
    name: '_dest_ip'
    args:
      - ip_ipv4
      - ip_ipv6

  - id: _dest_port
    type: DecimalIntegerValueModelElement
    name: '_dest_port'

  - id: _proto
    type: FixedWordlistDataModelElement
    name: '_proto'
    args:
      - 'UDP'
      - 'TCP'
      - 'IPv6-ICMP'

  - id: _icmp_type
    type: DecimalIntegerValueModelElement
    name: '_icmp_type'

  - id: _icmp_code
    type: DecimalIntegerValueModelElement
    name: '_icmp_code'

  - id: type
    type: FixedWordlistDataModelElement
    name: 'type'
    args:
      - 'answer'
      - 'query'

  - id: id
    type: DecimalIntegerValueModelElement
    name: 'id'

  - id: _rcode
    type: FixedWordlistDataModelElement
    name: '_rcode'
    args:
      - 'NXDOMAIN'
      - 'NOERROR'

  - id: rrname
    type: AnyByteDataModelElement
    name: 'rrname'

  - id: _rrtype
    type: AnyByteDataModelElement
    name: '_rrtype'

  - id: _ttl
    type: DecimalIntegerValueModelElement
    name: '_ttl'

  - id: _tx_id
    type: DecimalIntegerValueModelElement
    name: '_tx_id'

  - id: hostname
    type: AnyByteDataModelElement
    name: 'hostname'

  - id: url
    type: VariableByteDataModelElement
    name: 'url'
    args: 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_.;&=+$,/?%#\'

  - id: http_user_agent
    type: AnyByteDataModelElement
    name: 'http_user_agent'

  - id: _http_content_type
    type: FixedWordlistDataModelElement
    name: '_http_content_type'
    args:
      - 'text/html'
      - 'image/png'
      - 'application/javascript'
      - 'text/css'
      - 'image/vnd.microsoft.icon'
      - 'application/json'
      - 'image/gif'
      - 'audio/x-wav'
      - 'text/xml'
      - 'text/plain'
      - 'application/ocsp-response'

  - id: _http_refer
    type: AnyByteDataModelElement
    name: '_http_refer'

  - id: http_method
    type: FixedWordlistDataModelElement
    name: 'http_method'
    args:
      - 'GET'
      - 'POST'

  - id: protocol
    type: FixedDataModelElement
    name: 'protocol'
    args: 'HTTP/1.1'

  - id: _status
    type: DecimalIntegerValueModelElement
    name: '_status'

  - id: _redirect
    type: AnyByteDataModelElement
    name: '_redirect'

  - id: length
    type: DecimalIntegerValueModelElement
    name: 'length'

  - id: _app_proto
    type: FixedWordlistDataModelElement
    name: '_app_proto'
    args:
      - 'http'
      - 'failed'
      - 'dns'
      - 'tls'
      - 'ssh'
      - 'ntp'
      - 'smb'
      - 'smtp'
      - 'dhcp'

  - id: _app_proto_tc
    type: FixedWordlistDataModelElement
    name: '_app_proto_tc'
    args:
      - 'http'
      - 'failed'

  - id: file_state
    type: FixedWordlistDataModelElement
    name: 'state'
    args:
      - 'CLOSED'
      - 'TRUNCATED'

  - id: bool_wordlist
    type: FixedWordlistDataModelElement
    name: 'bool'
    args:
      - 'true'
      - 'false'

  - id: size
    type: DecimalIntegerValueModelElement
    name: 'size'

  - id: pkts_toserver
    type: DecimalIntegerValueModelElement
    name: 'pkts_toserver'

  - id: pkts_toclient
    type: DecimalIntegerValueModelElement
    name: 'pkts_toclient'

  - id: bytes_toserver
    type: DecimalIntegerValueModelElement
    name: 'bytes_toserver'

  - id: bytes_toclient
    type: DecimalIntegerValueModelElement
    name: 'bytes_toclient'

  - id: start
    type: DateTimeModelElement
    name: 'start'
    date_format: '%Y-%m-%dT%H:%M:%S.%f%z'

  - id: end
    type: DateTimeModelElement
    name: 'end'
    date_format: '%Y-%m-%dT%H:%M:%S.%f%z'

  - id: age
    type: DecimalIntegerValueModelElement
    name: 'age'

  - id: conn_state
    type: FixedWordlistDataModelElement
    name: 'state'
    args:
      - 'established'
      - 'closed'
      - 'fin_wait2'
      - 'new'
      - 'close_wait'
      - 'syn_sent'

  - id: reason
    type: FixedWordlistDataModelElement
    name: 'reason'
    args:
      - 'timeout'
      - 'shutdown'

  - id: uptime
    type: DecimalIntegerValueModelElement
    name: 'uptime'

  - id: kernel_packets
    type: DecimalIntegerValueModelElement
    name: 'kernel_packets'

  - id: kernel_drops
    type: DecimalIntegerValueModelElement
    name: 'kernel_drops'

  - id: errors
    type: DecimalIntegerValueModelElement
    name: 'errors'

  - id: pkts
    type: DecimalIntegerValueModelElement
    name: 'pkts'

  - id: bytes
    type: DecimalIntegerValueModelElement
    name: 'bytes'

  - id: invalid
    type: DecimalIntegerValueModelElement
    name: 'invalid'

  - id: ipv4
    type: DecimalIntegerValueModelElement
    name: 'ipv4'

  - id: ipv6
    type: DecimalIntegerValueModelElement
    name: 'ipv6'

  - id: ethernet
    type: DecimalIntegerValueModelElement
    name: 'ethernet'

  - id: chdlc
    type: DecimalIntegerValueModelElement
    name: 'chdlc'

  - id: raw
    type: DecimalIntegerValueModelElement
    name: 'raw'

  - id: null_counts
    type: DecimalIntegerValueModelElement
    name: 'null'

  - id: sll
    type: DecimalIntegerValueModelElement
    name: 'sll'

  - id: tcp
    type: DecimalIntegerValueModelElement
    name: 'tcp'

  - id: udp
    type: DecimalIntegerValueModelElement
    name: 'udp'

  - id: sctp
    type: DecimalIntegerValueModelElement
    name: 'sctp'

  - id: icmpv4
    type: DecimalIntegerValueModelElement
    name: 'icmpv4'

  - id: icmpv6
    type: DecimalIntegerValueModelElement
    name: 'icmpv6'

  - id: ppp
    type: DecimalIntegerValueModelElement
    name: 'ppp'

  - id: pppoe
    type: DecimalIntegerValueModelElement
    name: 'pppoe'

  - id: geneve
    type: DecimalIntegerValueModelElement
    name: 'geneve'

  - id: gre
    type: DecimalIntegerValueModelElement
    name: 'gre'

  - id: vlan
    type: DecimalIntegerValueModelElement
    name: 'vlan'

  - id: vlan_qinq
    type: DecimalIntegerValueModelElement
    name: 'vlan_qinq'

  - id: vxlan
    type: DecimalIntegerValueModelElement
    name: 'vxlan'

  - id: vntag
    type: DecimalIntegerValueModelElement
    name: 'vntag'

  - id: ieee8021ah
    type: DecimalIntegerValueModelElement
    name: 'ieee8021ah'

  - id: teredo
    type: DecimalIntegerValueModelElement
    name: 'teredo'

  - id: ipv4_in_ipv6
    type: DecimalIntegerValueModelElement
    name: 'ipv4_in_ipv6'

  - id: ipv6_in_ipv6
    type: DecimalIntegerValueModelElement
    name: 'ipv6_in_ipv6'

  - id: mpls
    type: DecimalIntegerValueModelElement
    name: 'mpls'

  - id: avg_pkt_size
    type: DecimalIntegerValueModelElement
    name: 'avg_pkt_size'

  - id: max_pkt_size
    type: DecimalIntegerValueModelElement
    name: 'max_pkt_size'

  - id: max_mac_addrs_src
    type: DecimalIntegerValueModelElement
    name: 'max_mac_addrs_src'

  - id: max_mac_addrs_dst
    type: DecimalIntegerValueModelElement
    name: 'max_mac_addrs_dst'

  - id: erspan
    type: DecimalIntegerValueModelElement
    name: 'erspan'

  - id: invalid_ip_version
    type: DecimalIntegerValueModelElement
    name: 'invalid_ip_version'

  - id: pkt_too_small
    type: DecimalIntegerValueModelElement
    name: 'pkt_too_small'

  - id: vju_pkt_too_small
    type: DecimalIntegerValueModelElement
    name: 'vju_pkt_too_small'

  - id: ip4_pkt_too_small
    type: DecimalIntegerValueModelElement
    name: 'ip4_pkt_too_small'

  - id: ip6_pkt_too_small
    type: DecimalIntegerValueModelElement
    name: 'ip6_pkt_too_small'

  - id: wrong_type
    type: DecimalIntegerValueModelElement
    name: 'wrong_type'

  - id: unsup_proto
    type: DecimalIntegerValueModelElement
    name: 'unsup_proto'

  - id: wrong_code
    type: DecimalIntegerValueModelElement
    name: 'wrong_code'

  - id: malformed_tags
    type: DecimalIntegerValueModelElement
    name: 'malformed_tags'

  - id: wrong_version
    type: DecimalIntegerValueModelElement
    name: 'wrong_version'

  - id: version0_recur
    type: DecimalIntegerValueModelElement
    name: 'version0_recur'

  - id: version0_flags
    type: DecimalIntegerValueModelElement
    name: 'version0_flags'

  - id: version0_hdr_too_big
    type: DecimalIntegerValueModelElement
    name: 'version0_hdr_too_big'

  - id: version0_malformed_sre_hdr
    type: DecimalIntegerValueModelElement
    name: 'version0_malformed_sre_hdr'

  - id: version1_chksum
    type: DecimalIntegerValueModelElement
    name: 'version1_chksum'

  - id: version1_route
    type: DecimalIntegerValueModelElement
    name: 'version1_route'

  - id: version1_ssr
    type: DecimalIntegerValueModelElement
    name: 'version1_ssr'

  - id: version1_recur
    type: DecimalIntegerValueModelElement
    name: 'version1_recur'

  - id: version1_flags
    type: DecimalIntegerValueModelElement
    name: 'version1_flags'

  - id: version1_no_key
    type: DecimalIntegerValueModelElement
    name: 'version1_no_key'

  - id: version1_wrong_protocol
    type: DecimalIntegerValueModelElement
    name: 'version1_wrong_protocol'

  - id: version1_malformed_sre_hdr
    type: DecimalIntegerValueModelElement
    name: 'version1_malformed_sre_hdr'

  - id: version1_hdr_too_big
    type: DecimalIntegerValueModelElement
    name: 'version1_hdr_too_big'

  - id: header_too_small
    type: DecimalIntegerValueModelElement
    name: 'header_too_small'

  - id: unknown_type
    type: DecimalIntegerValueModelElement
    name: 'unknown_type'

  - id: too_many_layers
    type: DecimalIntegerValueModelElement
    name: 'too_many_layers'

  - id: hlen_too_small
    type: DecimalIntegerValueModelElement
    name: 'hlen_too_small'

  - id: iplen_smaller_than_hlen
    type: DecimalIntegerValueModelElement
    name: 'iplen_smaller_than_hlen'

  - id: trunc_pkt
    type: DecimalIntegerValueModelElement
    name: 'trunc_pkt'

  - id: opt_invalid
    type: DecimalIntegerValueModelElement
    name: 'opt_invalid'

  - id: opt_invalid_len
    type: DecimalIntegerValueModelElement
    name: 'opt_invalid_len'

  - id: opt_malformed
    type: DecimalIntegerValueModelElement
    name: 'opt_malformed'

  - id: opt_pad_required
    type: DecimalIntegerValueModelElement
    name: 'opt_pad_required'

  - id: opt_eol_required
    type: DecimalIntegerValueModelElement
    name: 'opt_eol_required'

  - id: opt_duplicate
    type: DecimalIntegerValueModelElement
    name: 'opt_duplicate'

  - id: opt_unknown
    type: DecimalIntegerValueModelElement
    name: 'opt_unknown'

  - id: wrong_ip_version
    type: DecimalIntegerValueModelElement
    name: 'wrong_ip_version'

  - id: frag_pkt_too_large
    type: DecimalIntegerValueModelElement
    name: 'frag_pkt_too_large'

  - id: frag_overlap
    type: DecimalIntegerValueModelElement
    name: 'frag_overlap'

  - id: frag_ignored
    type: DecimalIntegerValueModelElement
    name: 'frag_ignored'

  - id: unknown_code
    type: DecimalIntegerValueModelElement
    name: 'unknown_code'

  - id: ipv4_trunc_pkt
    type: DecimalIntegerValueModelElement
    name: 'ipv4_trunc_pkt'

  - id: ipv4_unknown_ver
    type: DecimalIntegerValueModelElement
    name: 'ipv4_unknown_ver'

  - id: ipv6_trunc_pkt
    type: DecimalIntegerValueModelElement
    name: 'ipv6_trunc_pkt'

  - id: ipv6_unknown_version
    type: DecimalIntegerValueModelElement
    name: 'ipv6_unknown_version'

  - id: mld_message_with_invalid_hl
    type: DecimalIntegerValueModelElement
    name: 'mld_message_with_invalid_hl'

  - id: unassigned_type
    type: DecimalIntegerValueModelElement
    name: 'unassigned_type'

  - id: experimentation_type
    type: DecimalIntegerValueModelElement
    name: 'experimentation_type'

  - id: trunc_exthdr
    type: DecimalIntegerValueModelElement
    name: 'trunc_exthdr'

  - id: exthdr_dupl_fh
    type: DecimalIntegerValueModelElement
    name: 'exthdr_dupl_fh'

  - id: exthdr_useless_fh
    type: DecimalIntegerValueModelElement
    name: 'exthdr_useless_fh'

  - id: exthdr_dupl_rh
    type: DecimalIntegerValueModelElement
    name: 'exthdr_dupl_rh'

  - id: exthdr_dupl_hh
    type: DecimalIntegerValueModelElement
    name: 'exthdr_dupl_hh'

  - id: exthdr_dupl_dh
    type: DecimalIntegerValueModelElement
    name: 'exthdr_dupl_dh'

  - id: exthdr_dupl_ah
    type: DecimalIntegerValueModelElement
    name: 'exthdr_dupl_ah'

  - id: exthdr_dupl_eh
    type: DecimalIntegerValueModelElement
    name: 'exthdr_dupl_eh'

  - id: exthdr_invalid_optlen
    type: DecimalIntegerValueModelElement
    name: 'exthdr_invalid_optlen'

  - id: exthdr_ah_res_not_null
    type: DecimalIntegerValueModelElement
    name: 'exthdr_ah_res_not_null'

  - id: hopopts_unknown_opt
    type: DecimalIntegerValueModelElement
    name: 'hopopts_unknown_opt'

  - id: hopopts_only_padding
    type: DecimalIntegerValueModelElement
    name: 'hopopts_only_padding'

  - id: dstopts_unknown_opt
    type: DecimalIntegerValueModelElement
    name: 'dstopts_unknown_opt'

  - id: dstopts_only_padding
    type: DecimalIntegerValueModelElement
    name: 'dstopts_only_padding'

  - id: rh_type_0
    type: DecimalIntegerValueModelElement
    name: 'rh_type_0'

  - id: zero_len_padn
    type: DecimalIntegerValueModelElement
    name: 'zero_len_padn'

  - id: fh_non_zero_reserved_field
    type: DecimalIntegerValueModelElement
    name: 'fh_non_zero_reserved_field'

  - id: data_after_none_header
    type: DecimalIntegerValueModelElement
    name: 'data_after_none_header'

  - id: unknown_next_header
    type: DecimalIntegerValueModelElement
    name: 'unknown_next_header'

  - id: frag_invalid_length
    type: DecimalIntegerValueModelElement
    name: 'frag_invalid_length'

  - id: ipv4_in_ipv6_too_small
    type: DecimalIntegerValueModelElement
    name: 'ipv4_in_ipv6_too_small'

  - id: ipv4_in_ipv6_wrong_version
    type: DecimalIntegerValueModelElement
    name: 'ipv4_in_ipv6_wrong_version'

  - id: ipv6_in_ipv6_too_small
    type: DecimalIntegerValueModelElement
    name: 'ipv6_in_ipv6_too_small'

  - id: ipv6_in_ipv6_wrong_version
    type: DecimalIntegerValueModelElement
    name: 'ipv6_in_ipv6_wrong_version'

  - id: invalid_optlen
    type: DecimalIntegerValueModelElement
    name: 'invalid_optlen'

  - id: hlen_invalid
    type: DecimalIntegerValueModelElement
    name: 'hlen_invalid'

  - id: unsupported_type
    type: DecimalIntegerValueModelElement
    name: 'unsupported_type'

  - id: memcap
    type: DecimalIntegerValueModelElement
    name: 'memcap'

  - id: spare
    type: DecimalIntegerValueModelElement
    name: 'spare'

  - id: emerg_mode_entered
    type: DecimalIntegerValueModelElement
    name: 'emerg_mode_entered'

  - id: emerg_mode_over
    type: DecimalIntegerValueModelElement
    name: 'emerg_mode_over'

  - id: tcp_reuse
    type: DecimalIntegerValueModelElement
    name: 'tcp_reuse'

  - id: memuse
    type: DecimalIntegerValueModelElement
    name: 'memuse'

  - id: fragments
    type: DecimalIntegerValueModelElement
    name: 'fragments'

  - id: reassembled
    type: DecimalIntegerValueModelElement
    name: 'reassembled'

  - id: timeouts
    type: DecimalIntegerValueModelElement
    name: 'timeouts'

  - id: max_frag_hits
    type: DecimalIntegerValueModelElement
    name: 'max_frag_hits'

  - id: sessions
    type: DecimalIntegerValueModelElement
    name: 'sessions'

  - id: ssn_memcap_drop
    type: DecimalIntegerValueModelElement
    name: 'ssn_memcap_drop'

  - id: pseudo
    type: DecimalIntegerValueModelElement
    name: 'pseudo'

  - id: pseudo_failed
    type: DecimalIntegerValueModelElement
    name: 'pseudo_failed'

  - id: invalid_checksum
    type: DecimalIntegerValueModelElement
    name: 'invalid_checksum'

  - id: no_flow
    type: DecimalIntegerValueModelElement
    name: 'no_flow'

  - id: syn
    type: DecimalIntegerValueModelElement
    name: 'syn'

  - id: synack
    type: DecimalIntegerValueModelElement
    name: 'synack'

  - id: rst
    type: DecimalIntegerValueModelElement
    name: 'rst'

  - id: segment_memcap_drop
    type: DecimalIntegerValueModelElement
    name: 'segment_memcap_drop'

  - id: stream_depth_reached
    type: DecimalIntegerValueModelElement
    name: 'stream_depth_reached'

  - id: reassembly_gap
    type: DecimalIntegerValueModelElement
    name: 'reassembly_gap'

  - id: reassembly_memuse
    type: DecimalIntegerValueModelElement
    name: 'reassembly_memuse'

  - id: alert
    type: DecimalIntegerValueModelElement
    name: 'alert'

  - id: http
    type: DecimalIntegerValueModelElement
    name: 'http'

  - id: ftp
    type: DecimalIntegerValueModelElement
    name: 'ftp'

  - id: smtp
    type: DecimalIntegerValueModelElement
    name: 'smtp'

  - id: tls
    type: DecimalIntegerValueModelElement
    name: 'tls'

  - id: ssh
    type: DecimalIntegerValueModelElement
    name: 'ssh'

  - id: imap
    type: DecimalIntegerValueModelElement
    name: 'imap'

  - id: msn
    type: DecimalIntegerValueModelElement
    name: 'msn'

  - id: smb
    type: DecimalIntegerValueModelElement
    name: 'smb'

  - id: dcerpc_tcp
    type: DecimalIntegerValueModelElement
    name: 'dcerpc_tcp'

  - id: dns_tcp
    type: DecimalIntegerValueModelElement
    name: 'dns_tcp'

  - id: failed_tcp
    type: DecimalIntegerValueModelElement
    name: 'failed_tcp'

  - id: dcerpc_udp
    type: DecimalIntegerValueModelElement
    name: 'dcerpc_udp'

  - id: dns_udp
    type: DecimalIntegerValueModelElement
    name: 'dns_udp'

  - id: failed_udp
    type: DecimalIntegerValueModelElement
    name: 'failed_udp'

  - id: closed_pruned
    type: DecimalIntegerValueModelElement
    name: 'closed_pruned'

  - id: new_pruned
    type: DecimalIntegerValueModelElement
    name: 'new_pruned'

  - id: est_pruned
    type: DecimalIntegerValueModelElement
    name: 'est_pruned'

  - id: bypassed_pruned
    type: DecimalIntegerValueModelElement
    name: 'bypassed_pruned'

  - id: flows_checked
    type: DecimalIntegerValueModelElement
    name: 'flows_checked'

  - id: flows_notimeout
    type: DecimalIntegerValueModelElement
    name: 'flows_notimeout'

  - id: flows_timeout
    type: DecimalIntegerValueModelElement
    name: 'flows_timeout'

  - id: flows_timeout_inuse
    type: DecimalIntegerValueModelElement
    name: 'flows_timeout_inuse'

  - id: flows_removed
    type: DecimalIntegerValueModelElement
    name: 'flows_removed'

  - id: rows_checked
    type: DecimalIntegerValueModelElement
    name: 'rows_checked'

  - id: rows_skipped
    type: DecimalIntegerValueModelElement
    name: 'rows_skipped'

  - id: rows_empty
    type: DecimalIntegerValueModelElement
    name: 'rows_empty'

  - id: rows_busy
    type: DecimalIntegerValueModelElement
    name: 'rows_busy'

  - id: rows_maxlen
    type: DecimalIntegerValueModelElement
    name: 'rows_maxlen'

  - id: memcap_state
    type: DecimalIntegerValueModelElement
    name: 'memcap_state'

  - id: memcap_global
    type: DecimalIntegerValueModelElement
    name: 'memcap_global'

  - id: bad_label_router_alert
    type: DecimalIntegerValueModelElement
    name: 'bad_label_router_alert'

  - id: bad_label_implicit_null
    type: DecimalIntegerValueModelElement
    name: 'bad_label_implicit_null'

  - id: bad_label_reserved
    type: DecimalIntegerValueModelElement
    name: 'bad_label_reserved'

  - id: unknown_payload_type
    type: DecimalIntegerValueModelElement
    name: 'unknown_payload_type'

  - id: unsupported_version
    type: DecimalIntegerValueModelElement
    name: 'unsupported_version'

  - id: too_many_vlan_layers
    type: DecimalIntegerValueModelElement
    name: 'too_many_vlan_layers'

  - id: tcp_flags
    type: FixedWordlistDataModelElement
    name: 'tcp_flags'
    args:
      - '1b'
      - '1f'
      - '1a'
      - '17'
      - '13'
      - '16'
      - '12'
      - '06'
      - '00'
      - '1e'

  - id: tcp_flags_ts
    type: FixedWordlistDataModelElement
    name: 'tcp_flags_ts'
    args:
      - '1b'
      - '1f'
      - '1a'
      - '17'
      - '13'
      - '16'
      - '12'
      - '06'
      - '00'
      - '1e'

  - id: tcp_flags_tc
    type: FixedWordlistDataModelElement
    name: 'tcp_flags_tc'
    args:
      - '1b'
      - '1f'
      - '1a'
      - '17'
      - '13'
      - '16'
      - '12'
      - '06'
      - '00'
      - '1e'

  - id: action
    type: FixedWordlistDataModelElement
    name: 'action'
    args:
      - 'allowed'

  - id: gid
    type: DecimalIntegerValueModelElement
    name: 'gid'

  - id: signature_id
    type: DecimalIntegerValueModelElement
    name: 'signature_id'

  - id: rev
    type: DecimalIntegerValueModelElement
    name: 'rev'

  - id: get_used
    type: DecimalIntegerValueModelElement
    name: 'get_used'

  - id: get_used_eval
    type: DecimalIntegerValueModelElement
    name: 'get_used_eval'

  - id: get_used_eval_reject
    type: DecimalIntegerValueModelElement
    name: 'get_used_eval_reject'

  - id: get_used_eval_busy
    type: DecimalIntegerValueModelElement
    name: 'get_used_eval_busy'

  - id: get_used_failed
    type: DecimalIntegerValueModelElement
    name: 'get_used_failed'

  - id: spare_sync_avg
    type: DecimalIntegerValueModelElement
    name: 'spare_sync_avg'

  - id: spare_sync
    type: DecimalIntegerValueModelElement
    name: 'spare_sync'

  - id: spare_sync_incomplete
    type: DecimalIntegerValueModelElement
    name: 'spare_sync_incomplete'

  - id: spare_sync_empty
    type: DecimalIntegerValueModelElement
    name: 'spare_sync_empty'

  - id: flows_evicted_needs_work
    type: DecimalIntegerValueModelElement
    name: 'flows_evicted_needs_work'

  - id: flows_evicted_pkt_inject
    type: DecimalIntegerValueModelElement
    name: 'flows_evicted_pkt_inject'

  - id: flows_evicted
    type: DecimalIntegerValueModelElement
    name: 'flows_evicted'

  - id: local_pkts
    type: DecimalIntegerValueModelElement
    name: 'local_pkts'

  - id: local_bytes
    type: DecimalIntegerValueModelElement
    name: 'local_bytes'

  - id: local_capture_pkts
    type: DecimalIntegerValueModelElement
    name: 'local_capture_pkts'

  - id: local_capture_bytes
    type: DecimalIntegerValueModelElement
    name: 'local_capture_bytes'

  - id: closed
    type: DecimalIntegerValueModelElement
    name: 'closed'

  - id: flows_injected
    type: DecimalIntegerValueModelElement
    name: 'flows_injected'

  - id: full_hash_pass
    type: DecimalIntegerValueModelElement
    name: 'full_hash_pass'

  - id: midstream_pickups
    type: DecimalIntegerValueModelElement
    name: 'midstream_pickups'

  - id: pkt_on_wrong_thread
    type: DecimalIntegerValueModelElement
    name: 'pkt_on_wrong_thread'

  - id: overlap
    type: DecimalIntegerValueModelElement
    name: 'overlap'

  - id: overlap_diff_data
    type: DecimalIntegerValueModelElement
    name: 'overlap_diff_data'

  - id: insert_data_normal_fail
    type: DecimalIntegerValueModelElement
    name: 'insert_data_normal_fail'

  - id: insert_data_overlap_fail
    type: DecimalIntegerValueModelElement
    name: 'insert_data_overlap_fail'

  - id: insert_list_fail
    type: DecimalIntegerValueModelElement
    name: 'insert_list_fail'

  - id: id_str
    type: DecimalIntegerValueModelElement
    name: 'id_str'

  - id: last_reload
    type: DateTimeModelElement
    name: 'last_reload'
    date_format: '%Y-%m-%dT%H:%M:%S.%f%z'

  - id: rules_loaded
    type: DecimalIntegerValueModelElement
    name: 'rules_loaded'

  - id: rules_failed
    type: DecimalIntegerValueModelElement
    name: 'rules_failed'

  - id: nfs_tcp
    type: DecimalIntegerValueModelElement
    name: 'nfs_tcp'

  - id: ntp
    type: DecimalIntegerValueModelElement
    name: 'ntp'

  - id: ftp-data
    type: DecimalIntegerValueModelElement
    name: 'ftp-data'

  - id: tftp
    type: DecimalIntegerValueModelElement
    name: 'tftp'

  - id: ikev2
    type: DecimalIntegerValueModelElement
    name: 'ikev2'

  - id: krb5_tcp
    type: DecimalIntegerValueModelElement
    name: 'krb5_tcp'

  - id: dhcp
    type: DecimalIntegerValueModelElement
    name: 'dhcp'

  - id: snmp
    type: DecimalIntegerValueModelElement
    name: 'snmp'

  - id: sip
    type: DecimalIntegerValueModelElement
    name: 'sip'

  - id: rfb
    type: DecimalIntegerValueModelElement
    name: 'rfb'

  - id: mqtt
    type: DecimalIntegerValueModelElement
    name: 'mqtt'

  - id: rdp
    type: DecimalIntegerValueModelElement
    name: 'rdp'

  - id: http2
    type: DecimalIntegerValueModelElement
    name: 'http2'

  - id: nfs_udp
    type: DecimalIntegerValueModelElement
    name: 'nfs_udp'

  - id: krb5_udp
    type: DecimalIntegerValueModelElement
    name: 'krb5_udp'

  - id: expectations
    type: DecimalIntegerValueModelElement
    name: 'expectations'

  - id: open_files
    type: DecimalIntegerValueModelElement
    name: 'open_files'

  - id: version_nr
    type: DecimalIntegerValueModelElement
    name: 'version_nr'

  - id: flags
    type: VariableByteDataModelElement
    name: 'flags'
    args: '0123456789'

  - id: signature
    type: AnyByteDataModelElement
    name: 'signature'

  - id: category
    type: FixedWordlistDataModelElement
    name: 'category'
    args:
      - 'Potential Corporate Privacy Violation'
      - 'Potentially Bad Traffic'
      - 'Not Suspicious Traffic'

  - id: severity
    type: DecimalIntegerValueModelElement
    name: 'severity'

  - id: subject
    type: AnyByteDataModelElement
    name: 'subject'

  - id: issuerdn
    type: AnyByteDataModelElement
    name: 'issuerdn'

  - id: fingerprint
    type: VariableByteDataModelElement
    name: 'fingerprint'
    args: 'abcdef0123456789:'

  - id: rdata
    type: AnyByteDataModelElement
    name: 'rdata'

  - id: sni
    type: AnyByteDataModelElement
    name: 'sni'

  - id: version
    type: FixedWordlistDataModelElement
    name: 'version'
    args:
      - 'TLS 1.2'
      - 'verbose'
      - 'TLS 1.3'
      - 'UNDETERMINED'

  - id: notbefore
    type: DateTimeModelElement
    name: 'notbefore'
    date_format: '%Y-%m-%dT%H:%M:%S'

  - id: notafter
    type: DateTimeModelElement
    name: 'notafter'
    date_format: '%Y-%m-%dT%H:%M:%S'

  - id: proto_version
    type: FixedDataModelElement
    name: 'proto_version'
    args: '2.0'

  - id: software_version
    type: AnyByteDataModelElement
    name: 'software_version'

  - id: mname
    type: AnyByteDataModelElement
    name: 'mname'

  - id: rname
    type: AnyByteDataModelElement
    name: 'rname'

  - id: serial
    type: DecimalIntegerValueModelElement
    name: 'serial'

  - id: refresh
    type: DecimalIntegerValueModelElement
    name: 'refresh'

  - id: retry
    type: DecimalIntegerValueModelElement
    name: 'retry'

  - id: expire
    type: DecimalIntegerValueModelElement
    name: 'expire'

  - id: minimum
    type: DecimalIntegerValueModelElement
    name: 'minimum'

  - id: affected_product
    type: AnyByteDataModelElement
    name: 'affected_product'

  - id: attack_target
    type: AnyByteDataModelElement
    name: 'attack_target'

  - id: created_at
    type: DateTimeModelElement
    name: 'created_at'
    date_format: '%Y_%m_%d'

  - id: deployment
    type: AnyByteDataModelElement
    name: 'deployment'

  - id: signature_severity
    type: AnyByteDataModelElement
    name: 'signature_severity'

  - id: updated_at
    type: DateTimeModelElement
    name: 'updated_at'
    date_format: '%Y_%m_%d'

  - id: AAAA
    type: VariableByteDataModelElement
    name: 'AAAA'
    args: 'abcdef0123456789:'

  - id: CNAME
    type: AnyByteDataModelElement
    name: 'CNAME'

  - id: serial_str
    type: VariableByteDataModelElement
    name: 'serial_str'
    args: 'abcdefABCDEF0123456789:'

  - id: hash
    type: VariableByteDataModelElement
    name: 'hash'
    args: 'abcdef0123456789:'

  - id: string
    type: AnyByteDataModelElement
    name: 'string'

  - id: tls.anomaly.count
    type: DecimalIntegerValueModelElement
    name: 'tls.anomaly.count'

  - id: jsonEveModel  # this parser is not fully tested against all eve.json logs!
    #start: True
    type: JsonModelElement
    name: 'model'
    optional_key_prefix: '_'
    key_parser_dict:
      timestamp: timestamp
      _flow_id: _flow_id
      _in_iface: _in_iface
      event_type: event_type
      _src_ip: _src_ip
      _src_port: _src_port
      _dest_ip: _dest_ip
      _dest_port: _dest_port
      _proto: _proto
      _icmp_type: _icmp_type
      _icmp_code: _icmp_code
      _dns:
        _version: version_nr
        _type: type
        _id: id
        _rcode: _rcode
        _rrname: rrname
        _rrtype: _rrtype
        _ttl: _ttl
        _tx_id: _tx_id
        _flags: flags
        _qr: bool_wordlist
        _rd: bool_wordlist
        _ra: bool_wordlist
        _aa: bool_wordlist
        _answers:
          - rrname: rrname
            rrtype: _rrtype
            ttl: _ttl
            rdata: rdata
        _authorities:
          - rrname: rrname
            rrtype: _rrtype
            ttl: _ttl
            _soa:
              mname: mname
              rname: rname
              serial: serial
              refresh: refresh
              retry: retry
              expire: expire
              minimum: minimum
        _rdata: rdata
        _grouped:
          _A:
            - ip_ipv4
          _AAAA:
            - AAAA
          _CNAME:
            - CNAME
        _query:
          - type: type
            id: id
            rrname: rrname
            _rrtype: _rrtype
            _tx_id: _tx_id
      _tx_id: _tx_id
      _http:
        hostname: hostname
        url: url
        http_user_agent: http_user_agent
        _http_content_type: _http_content_type
        _http_refer: _http_refer
        http_method: http_method
        protocol: protocol
        _redirect: _redirect
        _status: _status
        length: length
      _app_proto: _app_proto
      _app_proto_tc: _app_proto_tc
      _fileinfo:
        filename: url
        state: file_state
        stored: bool_wordlist
        size: size
        _tx_id: _tx_id
        _sid: EMPTY_ARRAY
        _gaps: bool_wordlist
      _flow:
        pkts_toserver: pkts_toserver
        pkts_toclient: pkts_toclient
        bytes_toserver: bytes_toserver
        bytes_toclient: bytes_toclient
        start: start
        _end: end
        _age: age
        _state: conn_state
        _reason: reason
        _alerted: bool_wordlist
      _stats:
        uptime: uptime
        capture:
          kernel_packets: kernel_packets
          kernel_drops: kernel_drops
          _errors: errors
        decoder:
          pkts: pkts
          bytes: bytes
          invalid: invalid
          ipv4: ipv4
          ipv6: ipv6
          ethernet: ethernet
          _chdlc: chdlc
          raw: raw
          null: null_counts
          sll: sll
          tcp: tcp
          udp: udp
          sctp: sctp
          icmpv4: icmpv4
          icmpv6: icmpv6
          ppp: ppp
          pppoe: pppoe
          _geneve: geneve
          gre: gre
          vlan: vlan
          vlan_qinq: vlan_qinq
          _vxlan: vxlan
          _vntag: vntag
          _ieee8021ah: ieee8021ah
          teredo: teredo
          ipv4_in_ipv6: ipv4_in_ipv6
          ipv6_in_ipv6: ipv6_in_ipv6
          mpls: mpls
          avg_pkt_size: avg_pkt_size
          max_pkt_size: max_pkt_size
          _max_mac_addrs_src: max_mac_addrs_src
          _max_mac_addrs_dst: max_mac_addrs_dst
          erspan: erspan
          _ipraw:
            invalid_ip_version: invalid_ip_version
          _ltnull:
            pkt_too_small: pkt_too_small
            unsupported_type: unsupported_type
          _dce:
            pkt_too_small: pkt_too_small
          _event:
            ipv4:
              pkt_too_small: pkt_too_small
              hlen_too_small: hlen_too_small
              iplen_smaller_than_hlen: iplen_smaller_than_hlen
              trunc_pkt: trunc_pkt
              opt_invalid: opt_invalid
              opt_invalid_len: opt_invalid_len
              opt_malformed: opt_malformed
              opt_pad_required: opt_pad_required
              opt_eol_required: opt_eol_required
              opt_duplicate: opt_duplicate
              opt_unknown: opt_unknown
              wrong_ip_version: wrong_ip_version
              icmpv6: icmpv6
              frag_pkt_too_large: frag_pkt_too_large
              frag_overlap: frag_overlap
              frag_ignored: frag_ignored
            icmpv4:
              pkt_too_small: pkt_too_small
              unknown_type: unknown_type
              unknown_code: unknown_code
              ipv4_trunc_pkt: ipv4_trunc_pkt
              ipv4_unknown_ver: ipv4_unknown_ver
            icmpv6:
              pkt_too_small: pkt_too_small
              unknown_type: unknown_type
              unknown_code: unknown_code
              ipv6_trunc_pkt: ipv6_trunc_pkt
              ipv6_unknown_version: ipv6_unknown_version
              mld_message_with_invalid_hl: mld_message_with_invalid_hl
              unassigned_type: unassigned_type
              experimentation_type: experimentation_type
            ipv6:
              pkt_too_small: pkt_too_small
              trunc_pkt: trunc_pkt
              trunc_exthdr: trunc_exthdr
              exthdr_dupl_fh: exthdr_dupl_fh
              exthdr_useless_fh: exthdr_useless_fh
              exthdr_dupl_rh: exthdr_dupl_rh
              exthdr_dupl_hh: exthdr_dupl_hh
              exthdr_dupl_dh: exthdr_dupl_dh
              exthdr_dupl_ah: exthdr_dupl_ah
              exthdr_dupl_eh: exthdr_dupl_eh
              exthdr_invalid_optlen: exthdr_invalid_optlen
              wrong_ip_version: wrong_ip_version
              exthdr_ah_res_not_null: exthdr_ah_res_not_null
              hopopts_unknown_opt: hopopts_unknown_opt
              hopopts_only_padding: hopopts_only_padding
              dstopts_unknown_opt: dstopts_unknown_opt
              dstopts_only_padding: dstopts_only_padding
              rh_type_0: rh_type_0
              zero_len_padn: zero_len_padn
              fh_non_zero_reserved_field: fh_non_zero_reserved_field
              data_after_none_header: data_after_none_header
              unknown_next_header: unknown_next_header
              icmpv4: icmpv4
              frag_pkt_too_large: frag_pkt_too_large
              frag_overlap: frag_overlap
              frag_invalid_length: frag_invalid_length
              frag_ignored: frag_ignored
              ipv4_in_ipv6_too_small: ipv4_in_ipv6_too_small
              ipv4_in_ipv6_wrong_version: ipv4_in_ipv6_wrong_version
              ipv6_in_ipv6_too_small: ipv6_in_ipv6_too_small
              ipv6_in_ipv6_wrong_version: ipv6_in_ipv6_wrong_version
            vntag:
              header_too_small: header_too_small
              unknown_type: unknown_type
            ipraw:
              invalid_ip_version: invalid_ip_version
            ltnull:
              pkt_too_small: pkt_too_small
              unsupported_type: unsupported_type
            dce:
              pkt_too_small: pkt_too_small
            tcp:
              pkt_too_small: pkt_too_small
              hlen_too_small: hlen_too_small
              invalid_optlen: invalid_optlen
              opt_invalid_len: opt_invalid_len
              opt_duplicate: opt_duplicate
            udp:
              pkt_too_small: pkt_too_small
              hlen_too_small: hlen_too_small
              hlen_invalid: hlen_invalid
            sll:
              pkt_too_small: pkt_too_small
            ethernet:
              pkt_too_small: pkt_too_small
            ppp:
              pkt_too_small: pkt_too_small
              vju_pkt_too_small: vju_pkt_too_small
              ip4_pkt_too_small: ip4_pkt_too_small
              ip6_pkt_too_small: ip6_pkt_too_small
              wrong_type: wrong_type
              unsup_proto: unsup_proto
            pppoe:
              pkt_too_small: pkt_too_small
              wrong_code: wrong_code
              malformed_tags: malformed_tags
            gre:
              pkt_too_small: pkt_too_small
              wrong_version: wrong_version
              version0_recur: version0_recur
              version0_flags: version0_flags
              version0_hdr_too_big: version0_hdr_too_big
              version0_malformed_sre_hdr: version0_malformed_sre_hdr
              version1_chksum: version1_chksum
              version1_route: version1_route
              version1_ssr: version1_ssr
              version1_recur: version1_recur
              version1_flags: version1_flags
              version1_no_key: version1_no_key
              version1_wrong_protocol: version1_wrong_protocol
              version1_malformed_sre_hdr: version1_malformed_sre_hdr
              version1_hdr_too_big: version1_hdr_too_big
            vlan:
              header_too_small: header_too_small
              unknown_type: unknown_type
              too_many_layers: too_many_layers
            ieee8021ah:
              header_too_small: header_too_small
            sctp:
              pkt_too_small: pkt_too_small
            mpls:
              header_too_small: header_too_small
              pkt_too_small: pkt_too_small
              bad_label_router_alert: bad_label_router_alert
              bad_label_implicit_null: bad_label_implicit_null
              bad_label_reserved: bad_label_reserved
              unknown_payload_type: unknown_payload_type
            vxlan:
              unknown_payload_type: unknown_payload_type
            geneve:
              unknown_payload_type: unknown_payload_type
            erspan:
              header_too_small: header_too_small
              unsupported_version: unsupported_version
              too_many_vlan_layers: too_many_vlan_layers
            chdlc:
              pkt_too_small: pkt_too_small
          _too_many_layers: too_many_layers
        flow:
          memcap: memcap
          spare: spare
          emerg_mode_entered: emerg_mode_entered
          emerg_mode_over: emerg_mode_over
          tcp_reuse: tcp_reuse
          memuse: memuse
          _tcp: tcp
          _udp: udp
          _icmpv4: icmpv4
          _icmpv6: icmpv6
          _get_used: get_used
          _get_used_eval: get_used_eval
          _get_used_eval_reject: get_used_eval_reject
          _get_used_eval_busy: get_used_eval_busy
          _get_used_failed: get_used_failed
          _wrk:
            spare_sync_avg: spare_sync_avg
            spare_sync: spare_sync
            spare_sync_incomplete: spare_sync_incomplete
            spare_sync_empty: spare_sync_empty
            flows_evicted_needs_work: flows_evicted_needs_work
            flows_evicted_pkt_inject: flows_evicted_pkt_inject
            flows_evicted: flows_evicted
            flows_injected: flows_injected
          _mgr:
            full_hash_pass: full_hash_pass
            closed_pruned: closed_pruned
            new_pruned: new_pruned
            est_pruned: est_pruned
            bypassed_pruned: bypassed_pruned
            rows_maxlen: rows_maxlen
            flows_checked: flows_checked
            flows_notimeout: flows_notimeout
            flows_timeout: flows_timeout
            flows_timeout_inuse: flows_timeout_inuse
            flows_evicted: flows_evicted
            flows_evicted_needs_work: flows_evicted_needs_work
        defrag:
          ipv4:
            fragments: fragments
            reassembled: reassembled
            timeouts: timeouts
          ipv6:
            fragments: fragments
            reassembled: reassembled
            timeouts: timeouts
          max_frag_hits: max_frag_hits
        tcp:
          sessions: sessions
          ssn_memcap_drop: ssn_memcap_drop
          pseudo: pseudo
          pseudo_failed: pseudo_failed
          invalid_checksum: invalid_checksum
          no_flow: no_flow
          syn: syn
          synack: synack
          rst: rst
          segment_memcap_drop: segment_memcap_drop
          stream_depth_reached: stream_depth_reached
          reassembly_gap: reassembly_gap
          memuse: memuse
          reassembly_memuse: reassembly_memuse
          _midstream_pickups: midstream_pickups
          _pkt_on_wrong_thread: pkt_on_wrong_thread
          _overlap: overlap
          _overlap_diff_data: overlap_diff_data
          _insert_data_normal_fail: insert_data_normal_fail
          _insert_data_overlap_fail: insert_data_overlap_fail
          _insert_list_fail: insert_list_fail
        detect:
          alert: alert
          _engines:
            - id: id_str
              last_reload: last_reload
              rules_loaded: rules_loaded
              rules_failed: rules_failed
        app_layer:
          flow:
            http: http
            ftp: ftp
            smtp: smtp
            tls: tls
            ssh: ssh
            imap: imap
            _msn: msn
            smb: smb
            dcerpc_tcp: dcerpc_tcp
            dns_tcp: dns_tcp
            failed_tcp: failed_tcp
            dcerpc_udp: dcerpc_udp
            dns_udp: dns_udp
            failed_udp: failed_udp
            _nfs_tcp: nfs_tcp
            _ntp: ntp
            _ftp-data: ftp-data
            _tftp: tftp
            _ikev2: ikev2
            _krb5_tcp: krb5_tcp
            _dhcp: dhcp
            _snmp: snmp
            _sip: sip
            _rfb: rfb
            _mqtt: mqtt
            _rdp: rdp
            _http2: http2
            _nfs_udp: nfs_udp
            _krb5_udp: krb5_udp
          tx:
            http: http
            smtp: smtp
            tls: tls
            dns_tcp: dns_tcp
            dns_udp: dns_udp
            _ftp: ftp
            _ssh: ssh
            _imap: imap
            _smb: smb
            _dcerpc_tcp: dcerpc_tcp
            _nfs_tcp: nfs_tcp
            _ntp: ntp
            _ftp-data: ftp-data
            _tftp: tftp
            _ikev2: ikev2
            _krb5_tcp: krb5_tcp
            _dhcp: dhcp
            _snmp: snmp
            _sip: sip
            _rfb: rfb
            _mqtt: mqtt
            _rdp: rdp
            _http2: http2
            _dcerpc_udp: dcerpc_udp
            _nfs_udp: nfs_udp
            _krb5_udp: krb5_udp
          _expectations: expectations
        _flow_mgr:
          closed_pruned: closed_pruned
          new_pruned: new_pruned
          est_pruned: est_pruned
          bypassed_pruned: bypassed_pruned
          flows_checked: flows_checked
          flows_notimeout: flows_notimeout
          flows_timeout: flows_timeout
          flows_timeout_inuse: flows_timeout_inuse
          flows_removed: flows_removed
          rows_checked: rows_checked
          rows_skipped: rows_skipped
          rows_empty: rows_empty
          rows_busy: rows_busy
          rows_maxlen: rows_maxlen
        _flow_bypassed:
          local_pkts: local_pkts
          local_bytes: local_bytes
          local_capture_pkts: local_capture_pkts
          local_capture_bytes: local_capture_bytes
          closed: closed
          pkts: pkts
          bytes: bytes
        _dns:
          memuse: memuse
          memcap_state: memcap_state
          memcap_global: memcap_global
        http:
          memuse: memuse
          memcap: memcap
        _ftp:
          memuse: memuse
          memcap: memcap
        _file_store:
          open_files: open_files
      _tcp:
        tcp_flags: tcp_flags
        tcp_flags_ts: tcp_flags_ts
        tcp_flags_tc: tcp_flags_tc
        _syn: bool_wordlist
        _fin: bool_wordlist
        _rst: bool_wordlist
        _psh: bool_wordlist
        _ack: bool_wordlist
        _state: conn_state
      _alert:
        action: action
        gid: gid
        signature_id: signature_id
        rev: rev
        signature: signature
        category: category
        severity: severity
        _metadata:
          _affected_product:
            - affected_product
          _attack_target:
            - attack_target
          _created_at:
            - created_at
          _deployment:
            - deployment
          _signature_severity:
            - signature_severity
          _updated_at:
            - updated_at
      _tls:
        _subject: subject
        _issuerdn: issuerdn
        _fingerprint: fingerprint
        _session_resumed: bool_wordlist
        sni: sni
        version: version
        _notbefore: notbefore
        _notafter: notafter
        _serial: serial_str
        _ja3:
          hash: hash
          string: string
        _ja3s:
          _hash: hash
          _string: string
      _ssh:
        client:
          proto_version: proto_version
          software_version: software_version
        server:
          proto_version: proto_version
          software_version: software_version
      _metadata:
        flowints:
          tls.anomaly.count: tls.anomaly.count


Analysis:
  - type: StringRegexMatchRule
    id: stringRegexMatchRule
    path: "/model/opt/domain/domain"
    regex: "^((?!-)[A-Za-z0-9-]{1,63}(?<!-)\\.)+[A-Za-z]{2,6}(:[0-9]{1,5})*$"

Input:
  timestamp_paths: [""]
  multi_source: False
  adjust_timestamps: True
  #json_format: True

EventHandlers:
  - id: stpe
    type: StreamPrinterEventHandler
