{"ts": "2026-11-07T18:09:31+00:00", "source": "auditd", "key": "exec", "audit_key": "tool_exec", "syscall": "execve", "exe": "/usr/bin/bash", "uid": "1001", "pid": "953", "success": "yes", "argv": ["bash", "-c", "/tmp/tool-cmd.sh"], "path": "/bin/bash"}
{"ts": "2026-11-07T18:09:31+00:00", "source": "auditd", "key": "exec", "audit_key": "tool_exec", "syscall": "execve", "exe": "/usr/bin/bash", "uid": "1001", "pid": "953", "success": "yes", "argv": ["/bin/bash", "/tmp/tool-cmd.sh"], "path": "/tmp/tool-cmd.sh"}
{"ts": "2026-11-07T18:09:31+00:00", "source": "auditd", "key": "exec", "audit_key": "tool_exec", "syscall": "execve", "exe": "/usr/bin/python3.13", "uid": "1001", "pid": "953", "success": "yes", "argv": ["/home/tool/.local/falcon-mcp-venv/bin/python3", "/home/tool/.local/falcon-mcp-venv/bin/falcon-mcp", "--transport", "stdio", "--modules", "detections", "--read-only"], "path": "/home/tool/.local/falcon-mcp-venv/bin/falcon-mcp"}
{"ts": "2026-11-07T18:09:31+00:00", "source": "auditd", "key": "net", "audit_key": "tool_net", "syscall": "bind", "exe": "/usr/bin/python3.13", "uid": "1001", "pid": "953", "success": "no", "saddr": "0A000000000000000000000000000000000000000000000100000000\u001dSADDR={", "saddr_fam": "inet6"}
{"ts": "2026-11-07T18:09:31+00:00", "source": "auditd", "key": "cred", "audit_key": "cred", "syscall": "openat", "exe": "/usr/bin/python3.13", "uid": "1001", "pid": "953", "success": "yes", "path": "/home/tool/.netrc"}
{"ts": "2026-11-07T18:09:33+00:00", "source": "auditd", "key": "cred", "audit_key": "cred", "syscall": "openat", "exe": "/usr/bin/python3.13", "uid": "1001", "pid": "953", "success": "yes", "path": "/home/tool/.netrc"}
{"ts": "2026-11-07T18:09:33+00:00", "source": "auditd", "key": "cred", "audit_key": "cred", "syscall": "openat", "exe": "/usr/bin/python3.13", "uid": "1001", "pid": "953", "success": "yes", "path": "/home/tool/.netrc"}