anchor.diff:  
   [source,console]
   ----
  -GET my_index/_eql/search
  +GET /my_index/_eql/search
   {
     "query": """
       process where process.name = "regsvr32.exe"
  
positive.code: 
  [source,console]
  ----
  GET my_index/_eql/search
  {
    "query": """
      file where (file.name == "cmd.exe" and agent.id != "my_user")
  
negative.code: 
  [source,console]
  ----
  GET /my_index/_eql/search
  {
    "query": """
      sequence by agent.id
  