no yes /var/ossec/wodles/credentials/LOG_ANALYTICS_CREDENTIALS YOUR_TENANT_DOMAIN AzureActivity WORKSPACE_ID 1d /var/ossec/wodles/credentials/GRAPH_CREDENTIALS YOUR_TENANT_DOMAIN microsoft-entra_id auditLogs/directoryAudits 1d /var/ossec/wodles/credentials/STORAGE_CREDENTIALS .json json_inline 24h