<!-- Add inside ossec_config on the enrolled agent or manager.
     Mount the bridge's wazuh output directory read-only at this path.
     Collection must start before bridge activation. -->
<localfile>
  <location>/var/log/decisionterrain/audit/segment-*.jsonl</location>
  <log_format>json</log_format>
  <only-future-events max-size="64MB">no</only-future-events>
</localfile>
