soc/wazuh-docker/single-node/config/wazuh_cluster/local_decode...

<!-- SOC MVP local decoders (minimal production-safe set) -->

<decoder name="soc-kv-base">
  <prematch>soc_mvp_test=true</prematch>
</decoder>

<decoder name="soc-dns-ioc">
  <parent>soc-kv-base</parent>
  <prematch>source=dns</prematch>
</decoder>

<decoder name="soc-vmware-auth">
  <parent>soc-kv-base</parent>
  <prematch>source=vmware</prematch>
</decoder>

<decoder name="soc-log-monitor">
  <parent>soc-kv-base</parent>
  <prematch>source=log_monitor</prematch>
</decoder>

<decoder name="soc-windows-sysmon">
  <parent>soc-kv-base</parent>
  <prematch>source=windows_sysmon</prematch>
</decoder>