complianceitems mozdef plugin, take 1