WITH evs AS 
(SELECT DISTINCT "host.id" AS "device.uid", "host.id" AS "file.endpoint.uid", "host.id" AS "process.endpoint.uid", "host.id" AS "process.file.endpoint.uid", "host.id" AS "process.parent_process.endpoint.uid", "host.id" AS "process.parent_process.file.endpoint.uid", "host.id" AS "process.parent_process.user.endpoint.uid", "host.id" AS "process.user.endpoint.uid", "host.id" AS "reg_key.endpoint.uid", "host.id" AS "reg_value.endpoint.uid", "host.id" AS "actor.process.endpoint.uid", "host.id" AS "actor.process.file.endpoint.uid", "host.id" AS "actor.user.endpoint.uid", "host.name" AS "device.name", "host.name" AS "file.endpoint.name", "host.name" AS "process.endpoint.name", "host.name" AS "process.file.endpoint.name", "host.name" AS "process.parent_process.endpoint.name", "host.name" AS "process.parent_process.file.endpoint.name", "host.name" AS "process.parent_process.user.endpoint.name", "host.name" AS "process.user.endpoint.name", "host.name" AS "reg_key.endpoint.name", "host.name" AS "reg_value.endpoint.name", "host.name" AS "actor.process.endpoint.name", "host.name" AS "actor.process.file.endpoint.name", "host.name" AS "actor.user.endpoint.name", "os.name" AS "device.os", "os.name" AS "file.endpoint.os", "os.name" AS "process.endpoint.os", "os.name" AS "process.file.endpoint.os", "os.name" AS "process.parent_process.endpoint.os", "os.name" AS "process.parent_process.file.endpoint.os", "os.name" AS "process.parent_process.user.endpoint.os", "os.name" AS "process.user.endpoint.os", "os.name" AS "reg_key.endpoint.os", "os.name" AS "reg_value.endpoint.os", "os.name" AS "actor.process.endpoint.os", "os.name" AS "actor.process.file.endpoint.os", "os.name" AS "actor.user.endpoint.os", "user.name" AS "user.name", "user.id" AS "user.uid", "process.command_line" AS "process.cmd_line", "process.name" AS "process.name", "process.pid" AS "process.pid", "process.entity_id" AS "process.uid", "process.executable" AS "process.file.name", "process.executable" AS "process.file.path", "process.executable" AS "process.file.parent_folder", "process.parent.command_line" AS "process.parent_process.cmd_line", "process.parent.command_line" AS "actor.process.cmd_line", "process.parent.name" AS "process.parent_process.name", "process.parent.name" AS "actor.process.name", "process.parent.pid" AS "process.parent_process.pid", "process.parent.pid" AS "actor.process.pid", "process.parent.entity_id" AS "process.parent_process.uid", "process.parent.entity_id" AS "actor.process.uid" 
FROM events 
WHERE "os.name" IN ('Linux', 'Windows')), 
procs AS 
(SELECT DISTINCT "process.endpoint.uid" AS "endpoint.uid", "process.file.endpoint.uid" AS "file.endpoint.uid", "process.parent_process.endpoint.uid" AS "parent_process.endpoint.uid", "process.parent_process.file.endpoint.uid" AS "parent_process.file.endpoint.uid", "process.parent_process.user.endpoint.uid" AS "parent_process.user.endpoint.uid", "process.user.endpoint.uid" AS "user.endpoint.uid", "process.endpoint.name" AS "endpoint.name", "process.file.endpoint.name" AS "file.endpoint.name", "process.parent_process.endpoint.name" AS "parent_process.endpoint.name", "process.parent_process.file.endpoint.name" AS "parent_process.file.endpoint.name", "process.parent_process.user.endpoint.name" AS "parent_process.user.endpoint.name", "process.user.endpoint.name" AS "user.endpoint.name", "process.endpoint.os" AS "endpoint.os", "process.file.endpoint.os" AS "file.endpoint.os", "process.parent_process.endpoint.os" AS "parent_process.endpoint.os", "process.parent_process.file.endpoint.os" AS "parent_process.file.endpoint.os", "process.parent_process.user.endpoint.os" AS "parent_process.user.endpoint.os", "process.user.endpoint.os" AS "user.endpoint.os", "process.cmd_line" AS cmd_line, "process.name" AS name, "process.pid" AS pid, "process.uid" AS uid, "process.file.name" AS "file.name", "process.file.path" AS "file.path", "process.file.parent_folder" AS "file.parent_folder", "process.parent_process.cmd_line" AS "parent_process.cmd_line", "process.parent_process.name" AS "parent_process.name", "process.parent_process.pid" AS "parent_process.pid", "process.parent_process.uid" AS "parent_process.uid" 
FROM evs 
WHERE "endpoint.os" = 'Linux'), 
parents AS 
(SELECT DISTINCT "host.id" AS "endpoint.uid", "host.id" AS "file.endpoint.uid", "host.id" AS "user.endpoint.uid", "host.name" AS "endpoint.name", "host.name" AS "file.endpoint.name", "host.name" AS "user.endpoint.name", "os.name" AS "endpoint.os", "os.name" AS "file.endpoint.os", "os.name" AS "user.endpoint.os", "process.parent.command_line" AS cmd_line, "process.parent.name" AS name, "process.parent.pid" AS pid, "process.parent.entity_id" AS uid 
FROM events 
WHERE ("process.entity_id", "host.id") IN (SELECT DISTINCT uid, "endpoint.uid" 
FROM procs))
 SELECT DISTINCT * 
FROM parents
