1 **Phase 1: Completed pre-decoding.
2 full event: 'May 26 20:16:17 lili sudo: dcid : TTY=pts/1 ; PWD=/home/dcid ; USER=root ; COMMAND=/usr/bin/vi /etc/sudoers'
5 log: 'dcid : TTY=pts/1 ; PWD=/home/dcid ; USER=root ; COMMAND=/usr/bin/vi /etc/sudoers'
7 **Phase 2: Completed decoding.
12 status: '/usr/bin/vi /etc/sudoers'
14 **Phase 3: Completed filtering (rules).
17 Description: 'First time user executed sudo.'
18 **Alert to be generated.