zeek:
  policy:
    file_extraction:
      - application/x-dosexec: exe
      - application/pdf: pdf
      - application/msword: doc
      - application/vnd.ms-powerpoint: doc
      - application/rtf: doc
      - application/vnd.ms-word.document.macroenabled.12: doc
      - application/vnd.ms-word.template.macroenabled.12: doc
      - application/vnd.ms-powerpoint.template.macroenabled.12: doc
      - application/vnd.ms-excel: doc
      - application/vnd.ms-excel.addin.macroenabled.12: doc
      - application/vnd.ms-excel.sheet.binary.macroenabled.12: doc
      - application/vnd.ms-excel.template.macroenabled.12: doc
      - application/vnd.ms-excel.sheet.macroenabled.12: doc
      - application/vnd.openxmlformats-officedocument.presentationml.presentation: doc
      - application/vnd.openxmlformats-officedocument.presentationml.slide: doc
      - application/vnd.openxmlformats-officedocument.presentationml.slideshow: doc
      - application/vnd.openxmlformats-officedocument.presentationml.template: doc
      - application/vnd.openxmlformats-officedocument.spreadsheetml.sheet: doc
      - application/vnd.openxmlformats-officedocument.spreadsheetml.template: doc
      - application/vnd.openxmlformats-officedocument.wordprocessingml.document: doc
      - application/vnd.openxmlformats-officedocument.wordprocessingml.template: doc
      - application/vnd.ms-powerpoint.addin.macroenabled.12: doc
      - application/vnd.ms-powerpoint.slide.macroenabled.12: doc
      - application/vnd.ms-powerpoint.presentation.macroenabled.12: doc
      - application/vnd.ms-powerpoint.slideshow.macroenabled.12: doc
      - application/vnd.openxmlformats-officedocument: doc