Attempt to Disable IPTables or Firewall

process where host.os.type == "linux" and event.type == "start" and event.action in ("exec", "exec_event", "start") and
(
   /* disable FW */
  (
    (process.name == "ufw" and process.args == "disable") or
    (process.name == "iptables" and process.args in ("-F", "--flush", "-X", "--delete-chain") and process.args_count == 2) or
    (process.name in ("iptables", "ip6tables") and process.parent.args == "force-stop")
  ) or

   /* stop FW service */
  (
    (
      (process.name == "service" and process.args == "stop") or
      (process.name == "chkconfig" and process.args == "off") or
      (process.name == "update-rc.d" and process.args in ("remove", "disable")) or
      (process.name == "systemctl" and process.args in ("disable", "stop", "kill", "mask"))
    ) and
    process.args in ("firewalld", "ip6tables", "iptables", "firewalld.service", "ip6tables.service", "iptables.service")
  )
)