diff --git a/docs/pages/includes/plugins/finish-event-handler-config.mdx b/docs/pages/includes/plugins/finish-event-handler-config.mdx index 50874fdb0b716..795ba52253461 100644 --- a/docs/pages/includes/plugins/finish-event-handler-config.mdx +++ b/docs/pages/includes/plugins/finish-event-handler-config.mdx @@ -15,6 +15,21 @@ namespace = "default" # for the default window size. # The window size should be specified as a duration string, parsed by Go's time.ParseDuration. window-size = "24h" +# types is a comma-separated list of event types to search when forwarding audit +# events. For example, to limit forwarded events to user logins +# and new Access Requests, you can assign this field to +# "user.login,access_request.create". +types = "" +# skip-event-types is a comma-separated list of types of events to skip. For +# example, to forward all audit events except for new app deletion events, you +# can include the following assignment: +# skip-event-types = "app.delete" +skip-event-types: [] +# skip-session-types is a comma-separated list of session event types to skip. +# For example, to forward all session events except for malformed SQL packet +# events, you can include the following assignment: +# skip-session-types = "db.session.malformed_packet" +skip-session-types: [] [forward.fluentd] ca = "/home/bob/event-handler/ca.crt" @@ -48,6 +63,20 @@ eventHandler: # for the default window size. # The window size should be specified as a duration string, parsed by Go's time.ParseDuration. windowSize: "24h" + # types is a list of event types to search when forwarding audit + # events. For example, to limit forwarded events to user logins + # and new Access Requests, you can assign this field to: + # ["user.login", "access_request.create"] + types: [] + # skipEventTypes lists types of events to skip. For example, to forward all + # audit events except for new app deletion events, you can assign this to: + # ["app.delete"] + skipEventTypes: [] + # skipSessionTypes lists session event types to skip. For example, to forward + # all session events except for malformed SQL packet events, you can assign + # this to: + # ["db.session.malformed_packet"] + skipSessionTypes: [] teleport: address: "example.teleport.com:443"