config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_LINUX and 
 ((action_process_image_path contains "/arp" and 
 action_process_image_command_line contains "-a") or 
 (action_process_image_path contains "/ping" and 
 (action_process_image_command_line in ("* 10.*", "* 192.168.*", "* 172.16.*", "* 172.17.*", "* 172.18.*", "* 172.19.*", "* 172.20.*", "* 172.21.*", "* 172.22.*", "* 172.23.*", "* 172.24.*", "* 172.25.*", "* 172.26.*", "* 172.27.*", "* 172.28.*", "* 172.29.*", "* 172.30.*", "* 172.31.*", "* 127.*", "* 169.254.*")))))