https://github.com/jamf/jamfprotect/blob/main/unified_log_filters/third_party/sap_privileges_user_rights_elevations_and_demotions.yaml New filter should be: process == "PrivilegesDaemon" && eventMessage CONTAINS "SAPCorp
