{"ts":"2026-10-03T19:08:00Z","source":"auditd","key":"exec","syscall":"execve","path":"/usr/bin/node","exe":"/usr/bin/node","pid":3311,"uid":1001,"rule":"server process start"}
{"ts":"2026-10-03T19:08:01Z","source":"falco","key":"token-read","syscall":"openat","path":"/run/secrets/vuln_api_token","exe":"/usr/bin/node","pid":3311,"uid":1001,"rule":"read of the passed API token only"}