// lnx_auditd_authorized_keys_or_doas_change.yml
TargetFilename in~ ("/etc/doas.conf", "/etc/sudoers") or TargetFilename endswith "/.ssh/authorized_keys" or TargetFilename endswith "/.ssh/authorized_keys2" or TargetFilename startswith "/etc/doas.d/" or TargetFilename startswith "/etc/sudoers.d/"

// lnx_doas_execution.yml
Image endswith "/doas"

// lnx_sshd_accepted_password_keyonly_account.yml
"Accepted password for root from" or "Accepted password for alpine from"

