Clear Linux System Logs [snowflake-crowdstrikefdr_process]

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and (event_platform = 'Lin' or event_platform = 'Mac') and (((regexp_like(process, '.*(vi
| vim
| nano
| echo.*\\\>
| visudo
| rm
| shred
| wipe)\\\s.*', 'i') or (regexp_like(process, '.*(dd\\\s).*', 'i') and regexp_like(process, '.*[^a-z0-9]if[^a-z0-9].*', 'i')) or (regexp_like(process, '.*(cat\\\s).*', 'i') and regexp_like(process, '.*[^a-z]\\\/dev\\\/null.*', 'i')) or (regexp_like(process, '.*[^a-z]truncate[^a-z].*', 'i') and regexp_like(process, '.*[^a-z]0.*', 'i')) or (regexp_like(process, '.*[^a-z0-9]tee[^a-z0-9].*', 'i') and not regexp_like(process, '.*[^a-z]-a[^a-z].*', 'i'))) and (process ilike '%.log' or regexp_like(process, '.*[^a-z0-9](faillog
| secure
| syslog
| messages
| utmp
| wtmp
| httpd)[^a-z0-9].*', 'i'))) or process ilike '%covermyass%' )