✄𐘗
text code block:
✄𐘗from .alerts-security.*
| where kibana.alert.rule.name is not null and user.id is not null and
  // Exclude low severity alerts
  kibana.alert.risk_score > 21
| stats
    Esql.rule_name_distinct_count = COUNT_DISTINCT(kibana.alert.rule.name), 
    Esql.rule_id_distinct_count = COUNT_DISTINCT(kibana.alert.rule.rule_id),
    Esql.host_id_distinct_count = COUNT_DISTINCT(host.id),
    Esql.risk_score_distinct_count = COUNT_DISTINCT(kibana.alert.risk_score),
    Esql.event_dataset_distinct_count = COUNT_DISTINCT(event.dataset),
    Esql.rule_name_values = VALUES(kibana.alert.rule.name), 
    Esql.risk_score_values = VALUES(kibana.alert.risk_score), 
    Esql.event_dataset_values = VALUES(event.dataset), 
    Esql.event_module_values = VALUES(event.module), 
    Esql.process_command_line = VALUES(process.command_line), 
    Esql.host_id_values = VALUES(host.id), 
    Esql.source_ip_values = VALUES(source.ip), 
    Esql.destination_ip_values = VALUES(destination.ip) by user.id

| where Esql.rule_name_distinct_count >= 4 AND Esql.rule_id_distinct_count >= 2 and
  // Exclude known system accounts with matches in more than one host
  not (
    (length(TO_STRING(user.id)) <= 4 or user.id IN ("S-1-5-18", "S-1-5-19", "S-1-5-20", "0")) and
    (Esql.host_id_distinct_count >= 2 or Esql.host_id_distinct_count == 0)
  )

| keep user.id, Esql.*