// lnx_auditd_authorized_keys_or_doas_change.yml
DeviceFileEvents
| where FolderPath in~ ("/etc/doas.conf", "/etc/sudoers") or FolderPath endswith "/.ssh/authorized_keys" or FolderPath endswith "/.ssh/authorized_keys2" or FolderPath startswith "/etc/doas.d/" or FolderPath startswith "/etc/sudoers.d/"

// lnx_doas_execution.yml
DeviceProcessEvents
| where FolderPath endswith "/doas"

// lnx_sshd_accepted_password_keyonly_account.yml
Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:
  1) The value provided to processing pipeline's query_table parameter, if using a Python script.
  2) If the query_table is already set in the pipeline state, such as from a custom user-defined pipeline if using sigma-cli.

