datafeed_windows_anomalous_service.json

{
    "job_id": "JOB_ID",
    "indices": [
      "INDEX_PATTERN_NAME"
    ],
    "max_empty_searches": 10,
    "query": {
        "bool": {
          "filter": [
            {"term": {"event.code": "7045"}},
            {"term": {"agent.type": "winlogbeat"}}
          ]
        }
      }
}