anchor.diff:  Based on your previous query, you know `regsvr32` processes were associated with
   143 events. But how was `regsvr32.exe` first called? And who called it?
   
  -`regsvr32` is a command-line utility so narrowing your results to processes where
  -the command line was used may help.
  -
  -First, in the previous EQL query, change the `any` keyword to `process`. This
  -means the query will only match processes, which have an `event.category` of
  -`process`.
  -
  -Next, append `and process.command_line != null` to the query. Now the query will
  -only match processes with a command line value.
  +`regsvr32` is a command-line utility so it may help to narrow your results to
  +processes where the command line was used.
  +
  +Update the previous EQL query as follows:
  +
  +* Change the `any` keyword to `process`. This limits matches to events with an
  +`event.category` of `process`.
  +* Add the `and process.command_line != null` condition to match only
  +events with a command line value.
   
   You'll also need to remove the `filter_path=-hits.events` query parameter. This
   lets you retrieve the document source for any matching events.
  
positive.code: ----
  // NOTCONSOLE
  
  . Use the <<cat-indices,cat indices API>> to verify the dataset was indexed
  successfully.
  +
  [source,console]
  ----
  
negative.code: remote file
  
  To match, each event in the sequence must share the same process ID, recorded in
  the `process.pid` field.
  
  Based on the command line value seen in the previous result, you can expect to
  find a match. However, the sequence query isn't designed for that specific
  