Skip to content

Instantly share code, notes, and snippets.

@dcode

dcode/eql_snippets.md

Last active September 16, 2021 17:14
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save dcode/9e66dca040139c265807b8c9db94ed39 to your computer and use it in GitHub Desktop.
Save dcode/9e66dca040139c265807b8c9db94ed39 to your computer and use it in GitHub Desktop.
Download ZIP
Snippets of EQL for use in Elastic Timelines
Raw
eql_snippets.md

NOTE: These are escaped to work in the Timelines Correlation editor in Security app (namely Kibana escapes the slashes before sending to EQL) as of 7.14.0

  • Search file path using case-insensitive regex.
file where file.path regex~ """C:\\Users\\.*\\APPDATA\\ROAMING\\[A-Za-z0-9_]{96,192}"""
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment