Sample
CylanceOPTICS
EQL queries

Query DNS lookups for a specified URL:

network where dns.questions.question_name == "<URL>"

Query a specified WMI namespace:

application where event.subcategory == "wmi" and wmi_trace.namespace == "<namespace>"

Query files with any of the specified SHA256 values:

file where file.sha256 in ("<value>", "<value>", "<value>")

Query processes with the specified process name:

process where process.name == "<name>"

Query processes where the command line contains a specified string:

process where process.command_line like "<string>"

Query information about network connections to a specified IP address on a specified port:

network where network.destination.ip_address == "<IP>" and network.destination.port == "<port>"