✄𐘗
text code block:
✄𐘗process where host.os.type == "linux" and event.type == "start" and 
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "process_started") and
process.args in (
  "/sys/class/dmi/id/bios_version", "/sys/class/dmi/id/product_name", "/sys/class/dmi/id/chassis_vendor",
  "/proc/scsi/scsi", "/proc/ide/hd0/model"
) and not (
  user.name == "root" or
  ?process.parent.name in ("LinkManager.exe", "saposcol", "svc_snow_discovery") or
  ?process.working_directory == "/home/qualys" or
  ?process.parent.executable in (
    "/usr/sara/sbin/sys2prometheus", "/usr/sara/sbin/sys2ganglia", "/usr/libexec/valgrind/memcheck-amd64-linux",
    "/var/lib/cfengine3/modules/init_node", "/opt/emby-server/system/EmbyServer"
  )
)