✄𐘗
text code block:
✄𐘗host.os.type:linux and event.category:file and event.action:("opened-file" or "read-file" or "wrote-to-file") and
file.path : ("/etc/sysctl.conf" or "/etc/sysctl.d" or /etc/sysctl.d/*) and not (
  process.name:(
    dpkg or dockerd or unattended-upg or systemd-sysctl or python* or auditbeat or dpkg or pool*
  ) or
  process.executable:(
    /opt/sophos-spl/plugins/av/bin/* or /usr/bin/pacman or "/usr/lib/dracut/dracut-install" or /var/lib/elastic-agent/*
  )
)