Skip to content

Instantly share code, notes, and snippets.

@dcode
Last active Sep 16, 2021
Embed
What would you like to do?
Snippets of EQL for use in Elastic Timelines

NOTE: These are escaped to work in the Timelines Correlation editor in Security app (namely Kibana escapes the slashes before sending to EQL) as of 7.14.0

  • Search file path using case-insensitive regex.
file where file.path regex~ """C:\\Users\\.*\\APPDATA\\ROAMING\\[A-Za-z0-9_]{96,192}"""
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment