Hey folks, looking for some guidance on an

outbound_connections

event, where the path is

/bin/ps

. That's not making sense for me, wondering how local/remote ports from the log data figure into that.