anchor.diff:  .*Example*
   [%collapsible]
   =====
  -The following EQL query uses the `sequence by` keyword to match a sequence of
  -events that share the same `process.pid` value.
  +The following EQL query uses the `sequence by` keyword to match a
  +sequence of events that share the same `process.pid` value.
   
   [source,eql]
   ----
   sequence by process.pid
  -  [ process where process.name == "cmd.exe" ]
  -  [ process where process.name == "whoami.exe" ]
  +  [ process where event.type == "start" and process.name == "cmd.exe" ]
  +  [ process where file.extension == "exe" ]
   ----
   =====
   
  
positive.code: [[eql-until-keyword]]
  ==== `until` keyword
  
  You can use the `until` keyword to specify an expiration event for sequences.
  Matching sequences must end before this event, which is not included the
  results. If this event occurs within a sequence, the sequence is not considered
  a match.
  
  [source,eql]
  ----
  
negative.code:   [ event_category_1 where condition_1 ]
    [ event_category_2 where condition_2 ]
    ...
  until [ event_category_3 where condition_3 ]
  ----
  
  *Example* +
  A dataset contains the following event sequences, grouped by shared IDs:
  
  [source,txt]
  ----
  A, B
  A, B, C
  A, C, B
  ----
  
  The following EQL query searches the dataset for sequences containing
  event `A` followed by event `B`. Event `C` is used as an expiration event.
  
  [source,eql]
  ----
  sequence by ID
    A
    B
  until C
  ----
  
  The query matches sequences `A, B` and `A, B, C` but not `A, C, B`.
  
  [TIP]
  ====
  The `until` keyword can be useful when searching for process sequences in
  Windows event logs.
  
  In Windows, a process ID (PID) is unique only while a process is running. After
  a process terminates, its PID can be reused.
  