- macro: dangling append
  condition: and evt.type=execve
  append: true