- macro: some macro
  condition: evt.type=execve