✄𐘗
text code block:
✄𐘗sequence with maxspan=10s
  [process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and
    process.name in ("bash", "zsh", "sh") and
    process.args in ("-zsh", "-sh", "-bash") and process.args_count == 1 and
    process.parent.name == "login"] by process.entity_id
  [process where host.os.type == "macos" and event.type == "start" and event.action == "exec" and
    process.name in ("curl", "nscurl") and
    process.args in ("-o", "--output", "--download", "-dl", "-dir", "--directory", "-F", "--form") and
    not process.args like ("https://upload.elastic.co*", "https://vault-ci-prod.elastic.dev", "https://artifacts.elastic.co*")] by process.parent.entity_id