anchor.diff:  ----
   // TEST[setup:sec_logs]
   
  -The API returns the following response. A search ID is provided in the `id`
  -property. `is_partial` and `is_running` are `false`, indicating the EQL search
  -was synchronous and returned complete results in `hits`.
  +The response includes a search ID. `is_partial` and `is_running` are `false`,
  +indicating the EQL search was synchronous and returned complete results.
   
   [source,console-result]
   ----
  
positive.code: // TESTRESPONSE[s/"took": 52/"took": $body.took/]
  // TESTRESPONSE[s/"hits": \.\.\./"hits": $body.hits/]
  
  Use the search ID and the <<get-async-eql-search-api,get async EQL search API>>
  to retrieve the same results later.
  
  [source,console]
  ----
  
negative.code: By default, the EQL search API only stores async searches that cannot be
  completed within the period set by `wait_for_completion_timeout`.
  
  To save the results for a synchronous search, set `keep_on_completion` to
  `true`:
  
  [source,console]
  ----
  