✄𐘗
text code block:
✄𐘗FROM logs-endpoint.events.network-*
| WHERE host.os.type == "linux"
    AND event.action == "lookup_requested"
    AND host.id IS NOT NULL
    AND host.name IS NOT NULL
    AND user.name IS NOT NULL
    AND user.id IS NOT NULL
    AND process.executable IS NOT NULL
    AND dns.question.name LIKE "*.*"
    AND process.executable != "/usr/lib/systemd/systemd-resolved"
| EVAL Esql.dns_tld = MV_LAST(SPLIT(TO_LOWER(dns.question.name), "."))
| WHERE Esql.dns_tld IN (
    "forum", "pro", "team", "lol", "kr", "ke", "nu", "space", "capital", "in", "cfd", "online",
    "ru", "info", "top", "buzz", "xyz", "rest", "ml", "cf", "gq", "ga", "onion", "network",
    "monster", "marketing", "cyou", "quest", "cc", "bar", "click", "cam", "surf", "tk", "shop",
    "club", "icu", "pw", "ws", "fun", "life", "boats", "store", "hair", "mom", "beauty", "bond",
    "biz", "live", "zone"
  )
| STATS Esql.first_time_seen = MIN(@timestamp)
  BY host.id, host.name, user.name, user.id, process.executable, dns.question.name, data_stream.namespace
// New terms emulation: alert when the tuple was first seen recently within the 5-day history.
| EVAL Esql.recent_minutes = DATE_DIFF("minute", Esql.first_time_seen, NOW())
| WHERE Esql.recent_minutes <= 6
| KEEP host.id, host.name, user.name, user.id, process.executable, dns.question.name, data_stream.namespace