# EQL Sequence doesn't correlate events having same exact timestamp?

**URL:** <https://discuss.elastic.co/t/eql-sequence-doesnt-correlate-events-having-same-exact-timestamp/271845>\
**Category:** Elastic Security\
**Created:** [May 1, 2021, 1:26am UTC](https://discuss.elastic.co/t/eql-sequence-doesnt-correlate-events-having-same-exact-timestamp/271845 "2021-05-01T01:26:55Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![hilo21](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hilo21/32/66272_2.png) [@hilo21](https://discuss.elastic.co/u/hilo21)\
**Post date:** [May 1, 2021, 1:26am UTC](https://discuss.elastic.co/t/eql-sequence-doesnt-correlate-events-having-same-exact-timestamp/271845/1 "2021-05-01T01:26:55Z")

</div>

Hello,

I was trying to hunt for a specific behavior with EQL sequences and I have a question.

If events have the same exact timestamp EQL won't work.

Here is an example EQL Query :

```auto
sequence by winlog.event_data.TargetUserName with maxspan=10s
  [iam where event.action: "added-computer-account"]
  [iam where event.action: "reset-password"] 
  [iam where event.action: "changed-computer-account"]
  [iam where event.action: "enabled-user-account"]

```

It doesn't give me any correlated events :

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/9/d9370d2bdaaae2003a9a6c0913d0bf3bd89fc643.png)

but in the discover panel i can see that it should be hence my question :

![image](https://us1.discourse-cdn.com/elastic/original/3X/2/4/24997312134a483eb8e309761e9b2dc25dbc24fa.png)

Can I look for sequences with events generated in any order ?

Thank you

---

<div class="post-metadata">

**Author:** ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)\
**Post date:** [May 4, 2021, 8:38am UTC](https://discuss.elastic.co/t/eql-sequence-doesnt-correlate-events-having-same-exact-timestamp/271845/2 "2021-05-04T08:38:11Z")

</div>

Ive gone through this, EQL equires the time stamps to differ  
My logs had a nanosecond field which i could use as a tiebreaker. Issue is that tiebreakers are not available within a detection

I then used logstash to create a new timestamp based on the time + nanoseconds so that i had a more granular time, redid the index template to date\_nanos and modified the index pattern to use the new field

Then find detections use @timestamp, not whats defined in the patteren (mine was @timestamp\_nanos. I was considering flipping it so that @timestamp is nanos, then in the EQL guide it states date\_nanos is not supported

Fun

---

<div class="post-metadata">

**Author:** ![probson](https://avatars.discourse-cdn.com/v4/letter/p/e47c2d/32.png) [@probson](https://discuss.elastic.co/u/probson)\
**Post date:** [May 4, 2021, 8:40am UTC](https://discuss.elastic.co/t/eql-sequence-doesnt-correlate-events-having-same-exact-timestamp/271845/3 "2021-05-04T08:40:22Z")

</div>

You can access tiebreaker settings via the settings button bottom right

![image](https://us1.discourse-cdn.com/elastic/original/3X/6/7/67c22a088cf2dc2d94eb3477361c43eb7812b6da.png)

---

<div class="post-metadata">

**Author:** ![hilo21](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hilo21/32/66272_2.png) [@hilo21](https://discuss.elastic.co/u/hilo21)\
**Post date:** [May 9, 2021, 2:57pm UTC](https://discuss.elastic.co/t/eql-sequence-doesnt-correlate-events-having-same-exact-timestamp/271845/4 "2021-05-09T14:57:52Z")

</div>

Thanks a lot

---

<div class="post-metadata">

**Author:** ![matriv](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matriv/32/43656_2.png) [@matriv](https://discuss.elastic.co/u/matriv)\
**Post date:** [May 12, 2021, 9:02am UTC](https://discuss.elastic.co/t/eql-sequence-doesnt-correlate-events-having-same-exact-timestamp/271845/5 "2021-05-12T09:02:31Z")

</div>

At @hilo21 There is an [open issue](https://github.com/elastic/elasticsearch/issues/68812) for supporting date\_nanos for @timestamp in EQL.  
You can upvote it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 9, 2021, 9:03am UTC](https://discuss.elastic.co/t/eql-sequence-doesnt-correlate-events-having-same-exact-timestamp/271845/6 "2021-06-09T09:03:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.