---
- macro: some macro
  condition: evt.type=execve
---
- macro: some macro
  condition: foo
  append: false