from logs-endpoint.events.process-*
| keep @timestamp, host.os.type, event.type, event.action, process.parent.name, user.name, user.id, process.working_directory, process.name, process.command_line, process.parent.executable, agent.id, host.name
| where @timestamp > now() - 1 hours
| where host.os.type == "linux" and event.type == "start" and event.action == "exec" and (
  process.parent.name in (
    "apache", "nginx", "apache2", "httpd", "lighttpd", "caddy", "node", "mongrel_rails", "java", "gunicorn",
    "uwsgi", "openresty", "cherokee", "h2o", "resin", "puma", "unicorn", "traefik", "tornado", "hypercorn",
    "daphne", "twistd", "yaws", "webfsd", "httpd.worker", "flask", "rails", "mongrel"
  ) or
  process.parent.name like "php-*" or
  process.parent.name like "python*" or
  process.parent.name like "ruby*" or
  process.parent.name like "perl*" or
  user.name in (
    "apache", "www-data", "httpd", "nginx", "lighttpd", "tomcat", "tomcat8", "tomcat9", "ftp", "ftpuser", "ftpd"
  ) or
  user.id in ("99", "33", "498", "48") or
  process.working_directory like "/var/www/*"
) and
  process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.command_line like "* -c *" and
  not (
  process.working_directory like "/home/*" or
  process.working_directory like "/" or
  process.working_directory like "/vscode/vscode-server/*" or
  process.parent.executable like "/vscode/vscode-server/*" or
  process.parent.executable == "/usr/bin/xfce4-terminal"
)
| stats cc = count(), agent_count = count_distinct(agent.id), host.name = VALUES(host.name), agent.id = VALUES(agent.id) by process.command_line, process.working_directory, process.parent.executable
| where agent_count == 1 and cc < 5
| sort cc asc
| limit 100