# Conditional query for SIEM

**URL:** <https://discuss.elastic.co/t/conditional-query-for-siem/255330>\
**Category:** SIEM\
**Created:** [November 13, 2020, 11:03am UTC](https://discuss.elastic.co/t/conditional-query-for-siem/255330 "2020-11-13T11:03:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![lusynda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lusynda/32/53557_2.png) [@lusynda](https://discuss.elastic.co/u/lusynda)\
**Post date:** [November 13, 2020, 11:03am UTC](https://discuss.elastic.co/t/conditional-query-for-siem/255330/1 "2020-11-13T11:03:41Z")

</div>

Hi all  
I have some ability that i require SIEM do.  
i want to make a query and then if that query match then the second query will be call to search for that specific case since not all security case that happen in single log file but multiple log file.  
If that is not available then please make it a feature for SIEM.

---

<div class="post-metadata">

**Author:** ![borna\_talebi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/borna_talebi/32/76317_2.png) [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\
**Post date:** [November 15, 2020, 8:35am UTC](https://discuss.elastic.co/t/conditional-query-for-siem/255330/2 "2020-11-15T08:35:49Z")

</div>

Hi  
You can create sequences with EQL. take a look at [this](https://www.elastic.co/guide/en/elasticsearch/reference/master/eql.html#eql-search-sequence).

---

<div class="post-metadata">

**Author:** ![lusynda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lusynda/32/53557_2.png) [@lusynda](https://discuss.elastic.co/u/lusynda)\
**Post date:** [November 16, 2020, 1:31am UTC](https://discuss.elastic.co/t/conditional-query-for-siem/255330/3 "2020-11-16T01:31:04Z")

</div>

Yes thanks you for your respond.  
But i want to also know how to put that in to elastic SIEM since i dont really see a way to put EQL in any other than the console.

---

<div class="post-metadata">

**Author:** ![borna\_talebi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/borna_talebi/32/76317_2.png) [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\
**Post date:** [November 16, 2020, 6:03am UTC](https://discuss.elastic.co/t/conditional-query-for-siem/255330/4 "2020-11-16T06:03:50Z")

</div>

> [@lusynda](#):
>
> i dont really see a way to put EQL in any other than the console.

You can use it in SIEM after 7.10 update. take a look at [this](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-eql-rule).

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/1/71263606310a3a55c1b629e161f7085aafa8a961.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 14, 2020, 6:03am UTC](https://discuss.elastic.co/t/conditional-query-for-siem/255330/5 "2020-12-14T06:03:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.