datafeed_v3_windows_anomalous_network_activity.json

{
    "job_id": "JOB_ID",
    "indices": [
      "INDEX_PATTERN_NAME"
    ],
    "max_empty_searches": 10,
    "query": {
      "bool": {
        "filter": [
          {
            "term": {
              "event.category": "network"
            }
          },
          {
            "term": {
              "event.type": "start"
            }
          }
        ],
        "must": [
          {
            "bool": {
              "should": [
                {
                  "match": {
                    "host.os.family": {
                      "query": "windows",
                      "operator": "OR"
                    }
                  }
                },
                {
                  "match": {
                    "host.os.type": {
                      "query": "windows",
                      "operator": "OR"
                    }
                  }
                }
              ]
            }
          }
        ],
        "must_not": [
          {
            "bool": {
              "should": [
                {
                  "term": {
                    "destination.ip": "127.0.0.1"
                  }
                },
                {
                  "term": {
                    "destination.ip": "127.0.0.53"
                  }
                },
                {
                  "term": {
                    "destination.ip": "::1"
                  }
                }
              ],
              "minimum_should_match": 1
            }
          }
        ]
      }
    }
}