# EDR blocks rsyslog audit output
if $programname == 'audit' then {
    stop
}
if $programname == 'auditd' then {
    stop
}
if $msg contains 'audit:' then {
    stop
}