EQL query help

Elastic Security SIEM
1

Hi All,

I am using EQL to write detection rues. I have a sequence of evens as follows.
Event A
Event B
Event C

I want to raise an alert if the time between Event A and Event C exceeds 30 seconds. I tried with maxspan keyword but it only gives the upper bound but here I want lower bound limitation.

Please guide me

Thanks in advance.
Billz

1 Like
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.