#event_simpleName=/^(ProcessRollup2|CommandHistory)$/ event_platform=Win ((CommandLine=/(securityCenter2|csagent|csfalconservice)/i) OR (CommandHistory=/(securityCenter2|csagent|csfalconservice)/i) OR (ImageFileName=/netsh\.exe/i))