✄𐘗
text code block:
✄𐘗FROM logs-endpoint.events.network-* METADATA _id, _index, _version
| WHERE host.os.type == "linux"
    AND event.action IN ("lookup_requested", "lookup_result")
    AND process.executable IS NOT NULL
    AND (
      TO_LOWER(dns.question.name) LIKE "ecs-a-*.amazonaws.com*" OR
      TO_LOWER(dns.question.name) LIKE "ecs-t-*.amazonaws.com*"
    )
    AND NOT process.name IN ("amazon-ecs-agent", "ecs-agent", "amazon-ssm-agent", "aws-vpc-cni")
    AND NOT (
      process.executable == "/agent" OR
      process.executable == "/usr/bin/amazon-ecs-agent" OR
      process.executable LIKE "/managed-agents/*" OR
      process.executable LIKE "/usr/libexec/amazon-ecs-*" OR
      process.executable LIKE "/var/lib/ecs/*" OR
      process.executable LIKE "/opt/Elastic/Agent/*"
    )
| KEEP _id, _index, _version, @timestamp, data_stream.namespace, host.id, host.name, user.id, user.name,
    process.entity_id, process.parent.entity_id, process.pid, process.name, process.executable, dns.question.name