datafeed_v3_linux_anomalous_user_name.json

{
    "job_id": "JOB_ID",
    "indices": [
      "INDEX_PATTERN_NAME"
    ],
    "max_empty_searches": 10,
    "query": {
      "bool": {
        "filter": [
          {
            "term": {
              "event.category": "process"
            }
          },
          {
            "term": {
              "event.type": "start"
            }
          }
        ],
        "must": [
          {
            "bool": {
              "should": [
                {
                  "match": {
                    "host.os.type": {
                      "query": "linux",
                      "operator": "OR"
                    }
                  }
                },
                {
                  "match": {
                    "host.os.family": {
                      "query": "debian",
                      "operator": "OR"
                    }
                  }
                },
                {
                  "match": {
                    "host.os.family": {
                      "query": "redhat",
                      "operator": "OR"
                    }
                  }
                },
                {
                  "match": {
                    "host.os.family": {
                      "query": "suse",
                      "operator": "OR"
                    }
                  }
                },
                {
                  "match": {
                    "host.os.family": {
                      "query": "ubuntu",
                      "operator": "OR"
                    }
                  }
                }
              ]
            }
          }
        ]
      }
    }
}