from logs-endpoint.events.file-*
| keep @timestamp, host.os.type, event.type, event.action, user.name, user.id, process.name, process.executable, file.path, agent.id, host.name
| where @timestamp > now() - 1 hours
| where host.os.type == "linux" and event.type == "change" and event.action in ("rename", "creation") and (
     user.name in (
      "apache", "www-data", "httpd", "nginx", "lighttpd", "tomcat", "tomcat8", "tomcat9", "ftp", "ftpuser", "ftpd"
     ) or
     user.id in ("99", "33", "498", "48")
   ) and (
   process.name in (
    "apache", "nginx", "apache2", "httpd", "lighttpd", "caddy", "node", "mongrel_rails", "java", "gunicorn",
    "uwsgi", "openresty", "cherokee", "h2o", "resin", "puma", "unicorn", "traefik", "tornado", "hypercorn",
    "daphne", "twistd", "yaws", "webfsd", "httpd.worker", "flask", "rails", "mongrel"
  ) or
    process.name like "php-*" or
    process.name like "python*" or
    process.name like "ruby*" or
    process.name like "perl*"
   )
| stats cc = count(), agent_count = count_distinct(agent.id), host.name = VALUES(host.name), agent.id = VALUES(agent.id) by process.executable, file.path
| where agent_count == 1 and cc < 5
| sort cc asc
| limit 100