datafeed_v2_rare_process_by_host_windows_ecs.json

{
  "job_id": "JOB_ID",
  "indices": [
    "INDEX_PATTERN_NAME"
  ],
  "max_empty_searches": 10,
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "event.category": "process"
          }
        },
        {
          "term": {
            "event.type": "start"
          }
        }
      ],
      "must": [
        {
          "bool": {
            "should": [
              {
                "match": {
                  "host.os.family": {
                    "query": "windows",
                    "operator": "OR"
                  }
                }
              },
              {
                "match": {
                  "host.os.type": {
                    "query": "windows",
                    "operator": "OR"
                  }
                }
              }
            ]
          }
        }
      ]
    }
  }
}