anchor.diff:  
   This tutorial uses a test dataset for `regsvr32` misuse from
   https://github.com/redcanaryco/atomic-red-team[Atomic Red Team]. The dataset has
  -been normalized and mapped to use some fields from the {ecs-ref}[Elastic Common
  +been normalized and mapped to use fields from the {ecs-ref}[Elastic Common
   Schema (ECS)], including the `@timestamp` and `event.category` fields. The
   dataset includes events that imitate behaviors related to `regsvr32` misuse, as
   documented by MITRE ATT&CK®.
  
positive.code: ----
  // NOTCONSOLE
  
  . Use the <<cat-indices,cat indices API>> to verify the dataset was indexed
  successfully.
  +
  [source,console]
  ----
  
negative.code: remote file
  
  To match, each event in the sequence must share the same process ID, recorded in
  the `process.pid` field.
  
  Based on the command line value seen in the previous result, you can expect to
  find a match. However, the sequence query isn't designed for that specific
  