datafeed_v3_linux_anomalous_network_port_activity.json

{
    "job_id": "JOB_ID",
    "indices": [
      "INDEX_PATTERN_NAME"
    ],
    "max_empty_searches": 10,
    "query": {
        "bool": 
        {
          "filter": [
            {"term": {"event.category": "network"}},
            {"term": {"event.type": "start"}}
          ],
          "must": [
        {
          "bool": {
            "should": [
               {
                "match": {
                  "host.os.type": {
                    "query": "linux",
                    "operator": "OR"
                  }
                }
              },
              {
                "match": {
                  "host.os.family": {
                    "query": "debian",
                    "operator": "OR"
                  }
                }
              },
               {
                "match": {
                  "host.os.family": {
                    "query": "redhat",
                    "operator": "OR"
                  }
                }
              },
                 {
                "match": {
                  "host.os.family": {
                    "query": "suse",
                    "operator": "OR"
                  }
                }
              },
               {
                "match": {
                  "host.os.family": {
                    "query": "ubuntu",
                    "operator": "OR"
                  }
                }
              }
            ]
          }
        }
      ],
          "must_not": [
            {
              "bool": {
                "should": [
                  {"term": {"destination.ip": "127.0.0.1"}},
                  {"term": {"destination.ip": "127.0.0.53"}},
                  {"term": {"destination.ip": "::"}},
                  {"term": {"destination.ip": "::1"}},
                  {"term": {"user.name":"jenkins"}}
                ]
              }
            }
          ]
        }
    }
}