// ==== lnx_faspex_container_shell.yml | pipeline: sentinel_asim
imProcessCreate
| where ((ParentProcessName endswith "/containerd-shim" or ParentProcessName endswith "/containerd-shim-runc-v2" or ParentProcessName endswith "/runc") or (ActingProcessName endswith "/containerd-shim" or ActingProcessName endswith "/containerd-shim-runc-v2" or ActingProcessName endswith "/runc")) and (TargetProcessName endswith "/sh" or TargetProcessName endswith "/bash" or TargetProcessName endswith "/dash" or TargetProcessName endswith "/curl" or TargetProcessName endswith "/wget" or TargetProcessName endswith "/nc" or TargetProcessName endswith "/ncat" or TargetProcessName endswith "/socat" or TargetProcessName endswith "/python3" or TargetProcessName endswith "/perl")

// ==== lnx_faspex_file_change.yml | pipeline: sentinel_asim
imFileEvent
| where TargetFileName startswith "/opt/aspera/" or TargetFileName startswith "/etc/aspera/"

// ==== web_faspex_admin_api_paths.yml | pipeline: sentinel_asim
// CONVERSION FAILED: Error: Error while converting: Invalid SigmaDetectionItem field name encountered: cs-uri-stem. Please use valid fields for the imWebSession table, or the following fields that have fieldmappings in this pipeline: 

// ==== web_faspex_admin_api_write.yml | pipeline: sentinel_asim
// CONVERSION FAILED: Error: Error while converting: Invalid SigmaDetectionItem field name encountered: cs-uri-stem. Please use valid fields for the imWebSession table, or the following fields that have fieldmappings in this pipeline: 

// ==== web_faspex_download_spec.yml | pipeline: sentinel_asim
// CONVERSION FAILED: Error: Error while converting: Invalid SigmaDetectionItem field name encountered: cs-uri-stem. Please use valid fields for the imWebSession table, or the following fields that have fieldmappings in this pipeline: 

