# Filesystem options
fs:
  # List of directories to walk & watch
  watch:
    - /tmp/watchme
    - ./tmp
  # Blacklist files (simple case insensitive regex)
  blacklist:
    - badfile.*
    - deleteme[0-9]+
    - dontletmelive
# Process options
ps:
  # Watch for processes (no action)
  watch:
    - sketchy
  # Blacklist processes (partial case insensitive compare)
  blacklist:
    - malwareps
    - killthisproc
  # Blacklist processes for specific users
  prohibit:
    # Don't allow www-data user to run sh or bash processes
    www-data:
      - /bin/sh
      - /bin/bash