The generic Windows audit log config lacks many event ids, e.g.

• registry events
• driver load service addition events, System/7045 and Security/4697
• likely others

These functions can be put directly to containers-sig-* packages.

• !? as an operator version of lookup
• // for Map difference

For example, there's this useful operator:

infixl 9 !?
(!?) :: Key k => Map k v -> k -> Maybe v
(!?) m k = lookup k m

And probably there exist other useful functions with default implementations. We need to collect such functions an