Scheduled Task Initiation on Remote Endpoint - Update Analytics

[Badoodish]

One of the current filters: Processes.process=*/s* creates false positives because it matches on the /sc switch/argument for the schtasks.exe binary.
Recommend adding a space character like so: Processes.process=*/s *