✄𐘗
text code block:
✄𐘗FROM logs-endpoint.events.network-*
| WHERE host.os.type == "macos" 
    AND event.type == "start"
    AND (process.name == "osascript" 
         OR process.name == "node" 
         OR process.name LIKE "python*")
    AND (destination.domain LIKE "s3.*.amazonaws.com" 
         OR destination.domain LIKE "*.s3*.amazonaws.com" 
         OR destination.domain LIKE "*.cloudfront.net")
| STATS Esql.connection_count = COUNT(*) 
  BY process.executable, user.name, host.name, destination.domain
| WHERE Esql.connection_count >= 5
| KEEP Esql.*, process.executable, user.name, host.name, destination.domain