<group name="decisionterrain_audit,">
  <rule id="100210" level="3">
    <decoded_as>json</decoded_as>
    <field name="EventName" type="pcre2">^organization\.security$</field>
    <field name="SchemaVersion" type="pcre2">^1$</field>
    <description>Organization security event (metadata only).</description>
  </rule>
  <rule id="100211" level="7">
    <if_sid>100210</if_sid>
    <field name="Result" type="pcre2">^(denied|failed)$</field>
    <description>Organization security denial or failure.</description>
  </rule>
  <rule id="100212" level="3">
    <decoded_as>json</decoded_as>
    <field name="EventName" type="pcre2">^agent\.audit$</field>
    <field name="SchemaVersion" type="pcre2">^1$</field>
    <description>Agent audit event (existing metadata contract).</description>
  </rule>
  <rule id="100213" level="7">
    <if_sid>100212</if_sid>
    <field name="Result" type="pcre2">^(denied|failed)$</field>
    <description>Agent audit denial or failure.</description>
  </rule>
</group>
