config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 ((action_file_name in ("*{IFS}*", "*base64*", "*bash*", "*curl*", "*http*")) and 
 action_file_name contains "/opt/panlogs/tmp/device_telemetry/")