medium10 pts · first answer countssiemelasticeql
Reading an EQL sequence
What does this Elastic EQL query find?
sequence by host.id with maxspan=5m [file where event.type == "creation" and file.path : "C:\\Users\\*\\Downloads\\*.exe"] [process where event.type == "start" and process.executable : "C:\\Users\\*\\Downloads\\*.exe"]
Discussion 0
Join free to post in the discussion.
Related questions
- What stats count by does in SPLCybersecurity Analyst
- Grouping with summarize in KQLCybersecurity Analyst
- Why logs go to a SIEMCybersecurity Analyst
- Why normalise to a common schemaCybersecurity Analyst
- What a SIEM is forCybersecurity Analyst
- What a Splunk index isCybersecurity Analyst
- What sourcetype tells SplunkCybersecurity Analyst
- The Splunk Universal ForwarderCybersecurity Analyst