Some files in the repository are missing newlines at the very end, as pointed out by @nrbrook in #1026

Classes/CocoaLumberjack.h was specifically mentioned, but there could be other files that are missing this as well.

These configs are part of the "adding Logstash to filebeat modules getting started experience" and therefore its very likely the first time a user will see a LS config.

For the best experience we should add a fair few comments to better inform what is going on. The user sees the nested field reference for the first time and there is a try three grok pattern scheme with two mutate renames that w

Describe the bug
The PodSecurityPolicy included in the Promtail Helm chart does not grant the capabilities needed for running the privileged initContainer when the setting is enabled.

To Reproduce
Steps to reproduce the behavior:

1. Have a cluster with a baseline PodSecurityPolicy which prevents privileged pods.
2. Install promtail chart with initContainer enabled and PSP enabled. T

Someone should map publicly available EVTX samples to Sigma rules. This would enable us to automatically test the correctness of generated queries.

Known security-related EVTX repositories:

• https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES
• https://github.com/Cyb3rWard0g/mordor

Feel free to extend the list.

Mapping should be:

Sigma rule -> Repository/EVTX ( -> expected matched