process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start") and
  process.name == "openssl" and (
    (process.args == "s_client" and process.args : ("-connect", "*:*") and not process.args == "-showcerts") or
    (process.args == "s_server" and process.args == "-port")
  ) and
  not process.parent.executable in (
    "/pro/xymon/client/ext/awsXymonCheck.sh", "/opt/antidot-svc/nrpe/plugins/check_cert", "/etc/zabbix/scripts/check_dane_tlsa.sh"
  )