EQL - Alert on different values for the same field in a sequence


I am trying to build a sequence, as an example to look for multiple different user.names from the same host over a period of time. How would i go about this condition 2 user.name != condition 1 user.name. There a number of scenarios this would be useful for, i have looked through the documentation but cannot find what i am looking for.

    sequence by source.ip with maxspan=30s
      [ authentication where event.action:"logon-failed" and source.ip != "" ]
      [ authentication where event.action:"logon-failed" and source.ip != "" ]


hi @probson, glad to see you're using EQL.

With the EQL as of 7.10, there's no way to do the != check, but you can use by for the == check. What you're looking for will depend on the filter pipe, which is not yet implemented in Elasticsearch.

If you want to see some examples of how the filter pipe works for Elastic Endgame, here is its documentation.


That looks good so in theory we should be able to do the below when the filter pipe is released?

| filter events[0].user.name != events[1].user.name

looks like unique_count is what i would be really looking at, hopefully that will be implemented as well.