AzStackHciStandaloneObservability/package/bin/GMA/Monitoring/Agent/initconfig/2.0/Standard/AzSecMdsSystemEventsOffline.xml

<?xml version="1.0" encoding="utf-8"?>
<MonitoringManagement version="1.0" timestamp="2022-09-09T18:03:54.8774890Z">
  <!-- Autogenerated version comment - DO NOT REMOVE: AzSecPackShipVersion=4.22.0.2 -->
  <Imports>
    <Import file="AzSecMdsSystemEventsOffline-Content.xml" forceLocal="true">
      <Condition>GetEnvironmentVariable("AZSECPACK_DISABLED") != "1" &amp;&amp; (GetEnvironmentVariable("AZSECPACK_ENABLED_FEATURES") == "" || RegexMatch(GetEnvironmentVariable("AZSECPACK_ENABLED_FEATURES"), "SystemSecurityLog", 0, "i") != "")</Condition>
    </Import>
  </Imports>
</MonitoringManagement>