https://www.oryszczyn.com/filtering-events-on-the-microsoft-ama-syslog-agent-for-sentinel/