Restore except detections and events

Replaced a heap of (outdated) documentation with some vagrant/chef/script magic.

The main intent of this PR is to support @xhonner in the AATAMS audit work that he's doing.