[Rule Tuning] Interactive Terminal Spawned via Python

[w0rk3r]

Summary

Brings #1649 back to life now that we support type changes

[Aegrah]

Unit testing fix and a potential change of readibility / less easy to bypass (as most shell equivalents in Linux end with sh). Other than that, LGTM

[okbud12]

@w0rk3r the updated rule seems to be creating a lot of false positives. It is being triggered by services that perform health checks and configuration checks.

For example, OMS Agent in linux runs a python script which collects telemetry. This further spawns a bash shell that displays the process metrics.
Similarly, there are other more services related to Hadoop cluster monitoring that are creating same.

Not sure if this would be the ideal optimization but there could be a NOT process.command_line: (#All the commands to ignore) added in the query as well.

sequence with maxspan=1m
  [process where host.os.type == "linux" and event.type == "start" and process.name : "python*"] by process.entity_id
  [process where host.os.type == "linux" and event.type == "start" and 
   process.executable : "/bin/*sh"
   and process.command_line != " "
  ] by `process.parent.entity_id`

[w0rk3r]

@okbud12, thanks for reporting, I'll take a look at it and push a tuning