{"stages":[{"FILTER":{"filter":{"AND":[{"AND":[{"AND":[{"LEFT":"$event_type","OPERATOR":"EQ","RIGHT":"$PROCESS","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$event_sub_type","OPERATOR":"EQ","RIGHT":"$PROCESS_START","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"OR":[{"OR":[{"OR":[{"OR":[{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"arp","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"-a","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"ip","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"OR":[{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"addr","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"route","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}]},{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"ifconfig","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]},{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"netstat","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"REGEX","RIGHT":"netstat\\s(\\s*-\\w*[rnat]+\\s?)+","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]},{"AND":[{"LEFT":"$action_process_image_name","OPERATOR":"EQ","RIGHT":"route","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"},{"LEFT":"$action_process_image_command_line","OPERATOR":"CONTAINS","RIGHT":"-n","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}]}]},{"LEFT":"$actor_process_image_name","OPERATOR":"REGEX","RIGHT":"(ba|z|fi|tc|c|k)?sh","FILTER_DIALECT":"EXTENDED_FILTER_OBJ"}]}}}],"original_query":null,"tables":["xdr_data"]}