from logs-endpoint.events.process-*
| keep @timestamp, host.os.type, event.type, event.action, process.name, process.executable, process.parent.executable, process.command_line, agent.id, host.name
| where @timestamp > now() - 1 hours
| where host.os.type == "linux" and event.type == "start" and event.action == "exec" and
  process.name in ("scp", "ftp", "sftp", "vsftpd", "sftp-server", "rsync")
| stats cc = count(), agent_count = count_distinct(agent.id), host.name = VALUES(host.name), agent.id = VALUES(agent.id) by process.executable, process.parent.executable, process.command_line
| where agent_count == 1 and cc < 5
| sort cc asc
| limit 100