Process Discovery via Built-In Applications

event.category:process and host.os.type:(linux or macos) and event.type:start and event.action:(exec or exec_event) and
process.name:("ps" or "pstree" or "htop" or "pgrep") and not (
  process.parent.name:("amazon-ssm-agent" or "snap") or
  process.parent.args:("/usr/local/ASR/Vx/bin/status" or "/usr/sbin/ksmtuned") or
  process.parent.executable:(
    "/usr/bin/check_mk_agent" or /opt/gitlab/* or "/usr/bin/pmlogctl" or "/usr/libexec/pcp/bin/pmlogger_daily" or
    "/usr/libexec/pcp/bin/pmlogger_check"
  )
)