First version, one rule that monitors start process events