// sigma convert -t kusto --without-pipeline, generated 11 Nov 2026. NOT run against a live tenant.
// ===== lnx_file_checkmk_agent_plugin_spool.yml (--without-pipeline)
TargetFilename startswith "/usr/lib/check_mk_agent/plugins/" or TargetFilename startswith "/usr/lib/check_mk_agent/local/" or TargetFilename startswith "/var/lib/check_mk_agent/spool/"

// ===== lnx_file_checkmk_discovered_host_labels_non_mk.yml (--without-pipeline)
(TargetFilename startswith "/omd/sites/" and TargetFilename contains "/var/check_mk/discovered_host_labels/") and (not(TargetFilename endswith ".mk"))

// ===== lnx_file_checkmk_html_outside_robotmk_logs.yml (--without-pipeline)
(TargetFilename startswith "/omd/sites/" and (TargetFilename endswith ".html" or TargetFilename endswith ".htm")) and (not(TargetFilename contains "/var/robotmk/html_logs/"))

// ===== lnx_proc_checkmk_kube_agent_profile.yml (--without-pipeline)
CommandLine contains "agent_kube" and (CommandLine contains " --profile" or CommandLine contains "--cluster-aggregation-exclude-node-role=-")

// ===== lnx_proc_checkmk_site_user_shell.yml (--without-pipeline)
(ParentImage startswith "/omd/sites/" or ParentImage startswith "/omd/versions/") and (Image endswith "/sh" or Image endswith "/bash" or Image endswith "/dash" or Image endswith "/zsh" or Image endswith "/curl" or Image endswith "/wget" or Image endswith "/nc" or Image endswith "/ncat" or Image endswith "/socat")

// ===== win_file_checkmk_agent_plugin_spool.yml (--without-pipeline)
TargetFilename contains "\\ProgramData\\checkmk\\agent\\plugins\\" or TargetFilename contains "\\ProgramData\\checkmk\\agent\\local\\" or TargetFilename contains "\\ProgramData\\checkmk\\agent\\spool\\"

