datafeed_v3_windows_rare_user_runas_event.json

{
    "job_id": "JOB_ID",
    "indices": [
      "INDEX_PATTERN_NAME"
    ],
    "max_empty_searches": 10,
    "query": {
      "bool": {
        "filter": [
          {
            "term": {
              "event.code": "4648"
            }
          }
        ],
        "must": [
          {
            "bool": {
              "should": [
                {
                  "match": {
                    "host.os.family": {
                      "query": "windows",
                      "operator": "OR"
                    }
                  }
                },
                {
                  "match": {
                    "host.os.type": {
                      "query": "windows",
                      "operator": "OR"
                    }
                  }
                }
              ]
            }
          }
        ]
      }
    }
  }