anchor.diff:  remote file
   
   To match, each event in the sequence must share the same process ID, recorded in
  -the `process.pid` field. 
  +the `process.pid` field.
   
   Based on the command line value seen in the previous result, you can expect to
   find a match. However, the sequence query isn't designed for that specific
  
positive.code: ----
  // TEST[setup:atomic_red_regsvr32]
  +
  The API returns the following response. The `docs.count` value should show `150`
  documents were indexed.
  +
  [source,txt]
  
negative.code: 
  [discrete]
  [[eql-ex-get-a-count-of-regsvr32-events]]
  === Get a count of `regsvr32` events
  
  Since you're looking for `regsvr32` misuse, start by getting a count of any
  events associated with a `regsvr32.exe` process.
  