process where host.os.type == "linux" and event.type == "start" and
 event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
 (
  (process.name in ("nc", "ncat", "netcat", "nc.openbsd") and
   process.args == "-U" and process.args : ("/usr/local/*", "/run/*", "/var/run/*")) or
  (process.name == "socat" and
   process.args == "-" and process.args : ("UNIX-CLIENT:/usr/local/*", "UNIX-CLIENT:/run/*", "UNIX-CLIENT:/var/run/*")) or
  (process.name == "curl" and process.args : ("--unix-socket", "--abstract-unix-socket"))
) and
not (
  process.args == "/var/run/libvirt/libvirt-sock" or
  process.parent.name in ("bundle", "ruby", "haproxystatus.sh")
)