redef SMB::logged_file_actions += {
    SMB::PIPE_OPEN,
};