Skip Navigation

Sample
CylanceOPTICS
EQL queries

Query DNS lookups for a specified URL:
network where dns.questions.question_name == "
<URL>
"
Query a specified WMI namespace:
application where event.subcategory == "wmi" and wmi_trace.namespace == "
<namespace>
"
Query files with any of the specified SHA256 values:
file where file.sha256 in ("
<value>
", "
<value>
", "
<value>
")
Query processes with the specified process name:
process where process.name == "
<name>
"
Query processes where the command line contains a specified string:
process where process.command_line like "
<string>
"
Query information about network connections to a specified IP address on a specified port:
network where network.destination.ip_address == "
<IP>
" and network.destination.port == "
<port>
"