datafeed_linux_anomalous_network_service.json

{
    "job_id": "JOB_ID",
    "indices": [
      "INDEX_PATTERN_NAME"
    ],
    "max_empty_searches": 10,
    "query": {
        "bool": {
          "filter": [
            {"term": {"event.action": "bound-socket"}},
            {"term": {"agent.type": "auditbeat"}}
          ],
          "must_not": [
            {
              "bool": {
                "should": [
                  {"term": {"process.name": "dnsmasq"}},
                  {"term": {"process.name": "docker-proxy"}},
                  {"term": {"process.name": "rpcinfo"}}
                ],
                "minimum_should_match": 1
              }
            }
        ]
        }
      }
  }