KQL Comprehensive Tutorial on Event Correlation Rules

[wsouza (Wagner Souza)]

You can use EQL EQL syntax reference | Elasticsearch Guide [8.5] | Elastic for event mapping. Take a look at these links:

• https://www.elastic.co/en/security-labs/handy-elastic-tools-for-the-enthusiastic-detection-engineer

• https://www.threatbear.co/detecting-cve-2021-41379-using-eql-2ec67a644b25

• EQL search in Elastic SIEM Detection rules

• Event Query Language (EQL): Detections in space and time - YouTube