// ==== lnx_faspex_container_shell.yml | pipeline: microsoft_xdr
DeviceProcessEvents
| where (InitiatingProcessFolderPath endswith "/containerd-shim" or InitiatingProcessFolderPath endswith "/containerd-shim-runc-v2" or InitiatingProcessFolderPath endswith "/runc") and (FolderPath endswith "/sh" or FolderPath endswith "/bash" or FolderPath endswith "/dash" or FolderPath endswith "/curl" or FolderPath endswith "/wget" or FolderPath endswith "/nc" or FolderPath endswith "/ncat" or FolderPath endswith "/socat" or FolderPath endswith "/python3" or FolderPath endswith "/perl")

// ==== lnx_faspex_file_change.yml | pipeline: microsoft_xdr
DeviceFileEvents
| where FolderPath startswith "/opt/aspera/" or FolderPath startswith "/etc/aspera/"

// ==== web_faspex_admin_api_paths.yml | pipeline: microsoft_xdr
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:   1) The value provided to processing pipeline's query_table parameter, if using a Python script. 

// ==== web_faspex_admin_api_write.yml | pipeline: microsoft_xdr
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:   1) The value provided to processing pipeline's query_table parameter, if using a Python script. 

// ==== web_faspex_download_spec.yml | pipeline: microsoft_xdr
// CONVERSION FAILED: Error: Error while converting: Unable to determine table name from rule.  The query table is determined in the following order of priority:   1) The value provided to processing pipeline's query_table parameter, if using a Python script. 

