{
    "definition": "lookup update=true isWindowsSystemFile_lookup filename as process_name OUTPUT systemFile | search systemFile=true", 
    "description": "This macro limits the output to process names that are in the Windows System directory",
    "name": "isWindowsSystemFile"
}