index=activity AND rg_functionality="Endpoint Management Systems" AND (deviceaction = "Process Create" OR deviceaction = "Process Create (rule: ProcessCreate)" OR deviceaction = "ProcessRollup2") AND resourcecustomfield7  ENDS WITH "svchost.exe" AND resourcecustomfield2 CONTAINS "RPCSS"
index=activity AND rg_functionality="Endpoint Management Systems" AND (deviceaction = "Process Create" OR deviceaction = "Process Create (rule: ProcessCreate)" OR deviceaction = "ProcessRollup2") AND customstring59  ENDS WITH "svchost.exe" AND resourcecustomfield2 CONTAINS "RPCSS"
