// ==== lnx_faspex_container_shell.yml | pipeline: azure_monitor
SecurityEvent
| where (ParentProcessName endswith "/containerd-shim" or ParentProcessName endswith "/containerd-shim-runc-v2" or ParentProcessName endswith "/runc") and (NewProcessName endswith "/sh" or NewProcessName endswith "/bash" or NewProcessName endswith "/dash" or NewProcessName endswith "/curl" or NewProcessName endswith "/wget" or NewProcessName endswith "/nc" or NewProcessName endswith "/ncat" or NewProcessName endswith "/socat" or NewProcessName endswith "/python3" or NewProcessName endswith "/perl")

// ==== lnx_faspex_file_change.yml | pipeline: azure_monitor
SecurityEvent
| where ObjectName startswith "/opt/aspera/" or ObjectName startswith "/etc/aspera/"

// ==== web_faspex_admin_api_paths.yml | pipeline: azure_monitor
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:   1) The value provided to processing pipeline's query_table parameter, if using a Python script. 

// ==== web_faspex_admin_api_write.yml | pipeline: azure_monitor
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:   1) The value provided to processing pipeline's query_table parameter, if using a Python script. 

// ==== web_faspex_download_spec.yml | pipeline: azure_monitor
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:   1) The value provided to processing pipeline's query_table parameter, if using a Python script. 

