✄𐘗
text code block:
✄𐘗process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
(
  (
    process.name in (
      "iptables", "ip6tables", "iptables-nft", "ip6tables-nft", "iptables-legacy",
      "ip6tables-legacy", "xtables-nft-multi", "xtables-legacy-multi"
    ) and
    process.args in ("-A", "--append", "-I", "--insert", "-R", "--replace", "-P", "--policy") and
    process.args like~ ("DROP", "ACCEPT", "REJECT")
  ) or
  (
    process.name == "nft" and
    process.args in ("add", "insert", "replace") and
    process.args == "rule" and
    process.args like~ ("DROP", "ACCEPT", "REJECT") and
    not process.args in ("-c", "--check")
  ) or
  (
    process.name == "ufw" and
    process.args like~ ("deny", "allow", "reject") and
    not process.args in ("delete", "--dry-run")
  )
) and
not (
  process.parent.name in ("firewalld", "libvirtd") or
  process.parent.executable like (
    "/usr/bin/dockerd", "/usr/libexec/podman/netavark", "/usr/bin/cilium-agent", "/run/k0s/containerd/io.containerd.runtime.v2.task/k8s.io/*/cilium-agent",
    "/run/k3s/containerd/io.containerd.runtime.v2.task/k8s.io/*/cilium-agent", "/nix/store/*/docker/dockerd", "/usr/bin/fail2ban-server", "/usr/local/bin/dockerd",
    "/usr/sbin/NetworkManager", "/usr/sbin/tailscaled", "/var/lib/rancher/rke2/*/kubelet"
  )
)