anchor.diff:    [ event_category_1 where condition_1 ]
     [ event_category_2 where condition_2 ]
     ...
  -until [ event_category_2 where condition_2 ]
  -----
  -
  -.*Example*
  -[%collapsible]
  -====
  -The following EQL sequence query uses the `until` keyword to end sequences
  -before a process termination event. Process termination events have an event
  -category of `process` and `event.type` value of `termination`.
  -
  -[source,eql]
  -----
  -sequence
  -  [ file where file.extension == "exe" ]
  -  [ process where true ]
  -until [ process where event.type == "termination" ]
  -----
  -====
  +until [ event_category_3 where condition_3 ]
  +----
  +
  +*Example* +
  +A dataset contains the following event sequences, grouped by shared IDs:
  +
  +[source,txt]
  +----
  +A, B
  +A, B, C
  +A, C, B
  +----
  +
  +The following EQL query searches the dataset for sequences containing
  +event `A` followed by event `B`. Event `C` is used as an expiration event.
  +
  +[source,eql]
  +----
  +sequence by ID
  +  A
  +  B
  +until C
  +----
  +
  +The query matches sequences `A, B` and `A, B, C` but not `A, C, B`.
   
   [TIP]
   ====
  -The `until` keyword can be helpful when searching for process sequences in
  -Windows event logs, such as those ingested using
  -{winlogbeat-ref}/index.html[Winlogbeat].
  +The `until` keyword can be useful when searching for process sequences in
  +Windows event logs.
   
   In Windows, a process ID (PID) is unique only while a process is running. After
   a process terminates, its PID can be reused.
  
positive.code: [[eql-until-keyword]]
  ==== `until` keyword
  
  You can use the `until` keyword to specify an expiration event for sequences.
  Matching sequences must end before this event, which is not included the
  results. If this event occurs within a sequence, the sequence is not considered
  a match.
  
  [source,eql]
  ----
  
negative.code: [%collapsible]
  =====
  The following EQL query uses the `until` keyword to end sequences before
  `process` events with an `event.type` of `stop`. These events indicate a process
  has been terminated.
  
  [source,eql]
  ----
  sequence by process.pid
    [ process where event.type == "start" and process.name == "cmd.exe" ]
    [ process where file.extension == "exe" ]
  until [ process where event.type == "stop" ]
  ----
  =====
  
  