✄𐘗
text code block:
✄𐘗sequence by container.id, user.id with maxspan=5s
  [any where host.os.type == "linux" and event.category in ("file", "process") and process.interactive == true and container.id like "*" and (
    (event.category == "file" and event.type == "change" and event.action == "open" and file.path like "/var/lib/kubelet/pods/*") or
    (event.category == "process" and event.type == "start" and event.action == "exec" and (
      (process.name in ("du", "nice", "find", "locate", "ls")) or
      (process.args in (
        "du", "/bin/du", "/usr/bin/du", "/usr/local/bin/du",
        "nice", "/bin/nice", "/usr/bin/nice", "/usr/local/bin/nice",
        "find", "/bin/find", "/usr/bin/find", "/usr/local/bin/find",
        "locate", "/bin/locate", "/usr/bin/locate", "/usr/local/bin/locate",
        "ls", "/bin/ls", "/usr/bin/ls", "/usr/local/bin/ls"
      ))
    ) and process.args like "*/var/lib/kubelet/pods/*")
  )] with runs=5