<group name="windows,">
  <rule id="300100" level="3">
    <if_sid>60009</if_sid>
    <field name="win.system.providerName">^CiscoSecureEndpoint$</field>
    <options>no_full_log</options>
    <group>cisco_secure_endpoint,</group>
    <description>Cisco Secure Endpoint - Notification</description>
  </rule>
  <rule id="300101" level="12">
    <if_sid>300100</if_sid>
    <field name="win.system.message" type="pcre2">(?i)^"Quarantine</field>
    <options>no_full_log</options>
    <group>cisco_secure_endpoint,</group>
    <description>Cisco Secure Endpoint - Quarantine Event</description>
  </rule>
  <rule id="300102" level="12">
    <if_sid>300100</if_sid>
    <field name="win.system.message" type="pcre2">(?i)^"Malicious</field>
    <options>no_full_log</options>
    <group>cisco_secure_endpoint,</group>
    <description>Cisco Secure Endpoint - Malicious Event</description>
  </rule>
</group>
