flowbit fow "windows.reboot".  (Reboot detection)