datafeed_v3_linux_system_user_discovery.json

{
    "job_id": "JOB_ID",
    "indices": [
      "INDEX_PATTERN_NAME"
    ],
    "max_empty_searches": 10,
    "query": {
      "bool": {
        "filter": [
          {
            "term": {
              "event.type": "start"
            }
          }
        ],
        "must": [
          {
            "bool": {
              "should": [
                {
                  "match": {
                    "host.os.type": {
                      "query": "linux",
                      "operator": "OR"
                    }
                  }
                },
                {
                  "match": {
                    "host.os.family": {
                      "query": "debian",
                      "operator": "OR"
                    }
                  }
                },
                 {
                  "match": {
                    "host.os.family": {
                      "query": "redhat",
                      "operator": "OR"
                    }
                  }
                },
                   {
                  "match": {
                    "host.os.family": {
                      "query": "suse",
                      "operator": "OR"
                    }
                  }
                },
                 {
                  "match": {
                    "host.os.family": {
                      "query": "ubuntu",
                      "operator": "OR"
                    }
                  }
                }
              ]
            }
          },
          {
            "bool": {
              "should": [
                {
                  "term": {
                    "process.name": "users"
                  }
                },
                {
                  "term": {
                    "process.name": "w"
                  }
                },
                {
                  "term": {
                    "process.name": "who"
                  }
                },
                {
                  "term": {
                    "process.name": "whoami"
                  }
                }
              ]
            }
          }
        ]
      }
    }
}