(#event_simpleName=ProcessRollup2 CommandLine=/az\s+ad\s+user\s+list/i) OR (#event_simpleName=ProcessRollup2 CommandLine=/aws\s+iam\s+list\-(roles|users)/i) OR (#event_simpleName=ProcessRollup2 CommandLine=/gcloud\s+ (iam\s+service\-accounts\s+list|projects\s+get\-iam\-policy)/i)