datafeed_hosts_rare_process_activity_ecs.json

{
  "job_id": "JOB_ID",
  "indices": [
    "INDEX_PATTERN_NAME"
  ],
  "query": {
    "bool": {
      "filter": [
        { "term":  { "event.module": "auditd" } }
      ],
      "must": {
        "exists": { "field": "auditd.data.syscall" }
      },
      "must_not": {
        "exists": { "field": "container.runtime" }
      }
    }
  }
}