process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "executed", "process_started") and
(
  process.executable like~ ("/tmp/*", "/var/tmp/*", "/dev/shm/*", "/root/*", "/var/www/*", "./kubectl", "/home/*/kubectl") or
  process.name like ".*"
) and
process.command_line like~ (

  // get and describe commands
  "*get po*", "*get deploy*", "*get node*", "*get svc*", "*get service*", "*get secret*", "*get clusterrole*", "*get ingress*",
  "*get configmap*", "*describe po*", "*describe deploy*", "*describe node*", "*describe svc*", "*describe service*",
  "*describe secret*", "*describe configmap*", "*describe clusterrole*", "*describe ingress*",
  
  // exec commands
  "*exec -it*", "*exec --stdin*", "*exec --tty*",
  
  // networking commands
  "*port-forward* ", "*proxy --port*", "*run --image=*", "*expose*",

  // authentication/impersonation commands
  "*auth can-i*", "*--kubeconfig*", "*--as *", "*--as=*", "*--as-group*", "*--as-uid*"
) and not (
  process.executable like "/tmp/newroot/*" or
  process.name == ".flatpak-wrapped"
)