KQL Comprehensive Tutorial on Event Correlation Rules

Elastic Security SIEM
1

I need to build some rather complex rules, but I'm just getting started with KQL. I haven't found any in-depth comprehensive tuts out there on event correlation. Everything is always brief and basic. Anyone know of any good resource?

Thanks for chiming in!

2

You can use EQL EQL syntax reference | Elasticsearch Guide [8.5] | Elastic for event mapping. Take a look at these links:

1 Like
3

Thank you! That was really helpful!

1 Like
4

Fyi https://www.elastic.co/en/security-labs/handy-elastic-tools-for-the-enthusiastic-detection-engineer

gives me a 404

Guessing you mean

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.