datafeed_windows_anomalous_path_activity_ecs.json

{
    "job_id": "JOB_ID",
    "indices": [
      "INDEX_PATTERN_NAME"
    ],
    "max_empty_searches": 10,
    "query": {
        "bool": {
          "filter": [
            {"term": {"event.action": "Process Create (rule: ProcessCreate)"}},
            {"term": {"agent.type": "winlogbeat"}}
          ]
        }
      }
}