<def-group>
  <definition class="compliance" id="audit_rules_file_deletion_events" version="1">
    {{{ oval_metadata("Audit files deletion events.", rule_title=rule_title) }}}
    <criteria operator="AND">
      <extend_definition comment="audit rmdir" definition_ref="audit_rules_file_deletion_events_rmdir" />
      <extend_definition comment="audit unlink" definition_ref="audit_rules_file_deletion_events_unlink" />
      <extend_definition comment="audit unlinkat" definition_ref="audit_rules_file_deletion_events_unlinkat" />
      <extend_definition comment="audit rename" definition_ref="audit_rules_file_deletion_events_rename" />
      <extend_definition comment="audit renameat" definition_ref="audit_rules_file_deletion_events_renameat" />
      <extend_definition comment="audit renameat2" definition_ref="audit_rules_file_deletion_events_renameat2" />
    </criteria>
  </definition>

</def-group>
