[stealthData]
definition = index=* (sourcetype=STEALTHbits OR sourcetype=StealthINTERCEPT)
iseval = 0