Who Me Too'd this topic

Hey there,

I need some help with a query please.

I want a query that returns instances of two events, but ONLY when the events do NOT occur within 2 minutes of each other.

dataset = xdr_data
| filter (event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_STOP and actor_process_image_name = "PanGPS.exe") or (action_evtlog_event_id = 1074 and action_evtlog_message contains "has initiated the restart of computer")

The above returns all the stuff I want to look at. What I want to do is further filter it where the two events are independent of each other and don't occur together within a couple of minutes.

In plain English I want to know when the PanGPS.exe process is stopped, but only when it is not due to a system reboot.

Thanks!