What are the use cases of EQL in elasticsearch?

Elastic Stack Elasticsearch
1

What are the use cases of EQL in elasticsearch , Please explain with example ?

2

Hello @jaimika_kosambia,

EQL or Event Query Language is a declarative language dedicated for identifying patterns and relationships between events.

Consider using EQL if you:

  • Use Elasticsearch for threat hunting or other security use cases
  • Search time-series data or logs, such as network or system logs
  • Want an easy way to explore relationships between events
3

Here are some resources that may be useful:

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.