{
  "event": "capset",
  "pid": 4242,
  "ppid": 1,
  "uid": 1000,
  "comm": "python3",
  "capabilities": ["CAP_SYS_ADMIN"]
}