:programname, startswith, "crowdsec" stop
