#event_simpleName=/(OsVersionInfo|ConfigStateUpdate|SensorHeartbeat)/

| event_platform=Lin
| groupBy([cid, aid], function=([selectLast([ConfigStateData, OSVersionString, SensorStateBitMap])]))
| ConfigStateData match {

	/1400000000c4/ => isInUserMode:="1" ;
 * => isInUserMode:="0" ;
}

| SensorStateBitMap match {

 2 => isInRFM:="1" ;
 0 => isInRFM:="0" ;
 }

| case {

		 isInUserMode=1 AND isInRFM=1 | message := "User Mode Enabled" ;

  	 isInUserMode=0 AND isInRFM=0 | message := "Kernel Mode Enabled" ;
  	 isInUserMode=0 AND isInRFM=1 | message := "RFM" ;
 * }

| OSVersionString = /^Linux\s(?<hostName>\S+)\s(?<kernelVersion>\S+)\s/i
| aid=?aid hostName=?hostName message=?message
| select([aid, hostName, Version, kernelVersion, isInRFM, isInUserMode, message])