index=activity AND rg_functionality="Endpoint Management Systems" AND (deviceaction = "ProcessRollup2" or deviceaction = "Procstart" or deviceaction = "Childproc" or deviceaction = "Process" or deviceaction = "Process Create" or deviceaction = "Trace Executed Process" or baseeventid=1 or baseeventid=11) AND resourcecustomfield8 STARTS WITH "c:\windows\system32\spool\drivers\x64\3\old\ "
