✄𐘗
text code block:
✄𐘗sequence by process.entity_id with maxspan=1m
[process where host.os.type == "linux" and event.type == "start" and 
 (
  (process.name regex~ """php?[0-9]?\.?[0-9]{0,2}""" and process.command_line like "*-S*") or
  (process.name like "python*" and process.command_line like ("*--cgi*", "*CGIHTTPServer*"))
 ) and not process.parent.command_line == "runc init"
]
[network where host.os.type == "linux" and event.type == "start" and event.action == "connection_accepted"]