✄𐘗
text code block:
✄𐘗FROM logs-endpoint.events.file-* METADATA _id, _version, _index
| WHERE event.type IN ("creation", "change")
  AND TO_LOWER(file.name) IN ("agents.md", "claude.md")
  AND (
    file.path LIKE "/Users/*/Downloads/*"
    OR file.path LIKE "/home/*/Downloads/*"
    OR file.path LIKE """C:\\Users\\*\\Downloads\\*"""
  )
  AND (
    TO_LOWER(process.name) IN (
      "google chrome", "chrome.exe", "chrome", "chromium", "chromium-browser", "google-chrome",
      "microsoft edge", "msedge.exe", "microsoft-edge",
      "firefox", "firefox.exe",
      "safari",
      "brave browser", "brave.exe", "brave", "brave-browser",
      "opera", "opera.exe",
      "vivaldi", "vivaldi.exe",
      "explorer.exe",
      "com.apple.webkit.networking",
      "7z.exe", "7zg.exe", "7zfm.exe", "7z", "7zz",
      "winrar.exe", "rar.exe", "unrar.exe", "rar", "unrar",
      "winzip.exe", "winzip64.exe",
      "bandizip.exe", "peazip.exe",
      "tar.exe", "tar", "bsdtar",
      "unzip.exe", "unzip", "unar", "ditto",
      "archive utility", "bomarchivehelper",
      "the unarchiver", "keka",
      "file-roller", "ark"
    )
    OR TO_LOWER(process.name) LIKE (
      "google chrome helper*",
      "microsoft edge helper*",
      "brave browser helper*",
      "opera helper*",
      "vivaldi helper*"
    )
  )
| KEEP
    _id,
    _version,
    _index,
    data_stream.namespace,
    @timestamp,
    host.name,
    host.id,
    agent.id,
    user.name,
    user.domain,
    event.type,
    event.action,
    file.name,
    file.path,
    process.name,
    process.executable,
    process.entity_id