Skip to content

Commit 573cddc

Browse files
jrodewigjrodewig
authored
[DOCS] Make EQL example snippets more realistic (#60971) (#60975)
1 parent ed04dec commit 573cddc

File tree

3 files changed

+117
-131
lines changed

3 files changed

+117
-131
lines changed

‎docs/build.gradle‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -211,17 +211,17 @@ buildRestTests.setups['sec_logs'] = '''
211211
refresh: true
212212
body: |
213213
{"index":{}}
214-
{"@timestamp": "2020-12-06T11:04:05.000Z", "event": { "category": "process", "id": "edwCRnyD", "sequence": 1 }, "process": { "pid": 2012, "name": "cmd.exe", "executable": "C:\\\\Windows\\\\System32\\\\cmd.exe" }}
214+
{"@timestamp": "2099-12-06T11:04:05.000Z", "event": { "category": "process", "id": "edwCRnyD", "sequence": 1 }, "process": { "pid": 2012, "name": "cmd.exe", "executable": "C:\\\\Windows\\\\System32\\\\cmd.exe" }}
215215
{"index":{}}
216-
{"@timestamp": "2020-12-06T11:04:07.000Z", "event": { "category": "file", "id": "dGCHwoeS", "sequence": 2 }, "file": { "accessed": "2020-12-07T11:07:08.000Z", "name": "cmd.exe", "path": "C:\\\\Windows\\\\System32\\\\cmd.exe", "type": "file", "size": 16384 }, "process": { "pid": 2012, "name": "cmd.exe", "executable": "C:\\\\Windows\\\\System32\\\\cmd.exe" }}
216+
{"@timestamp": "2099-12-06T11:04:07.000Z", "event": { "category": "file", "id": "dGCHwoeS", "sequence": 2 }, "file": { "accessed": "2099-12-07T11:07:08.000Z", "name": "cmd.exe", "path": "C:\\\\Windows\\\\System32\\\\cmd.exe", "type": "file", "size": 16384 }, "process": { "pid": 2012, "name": "cmd.exe", "executable": "C:\\\\Windows\\\\System32\\\\cmd.exe" }}
217217
{"index":{}}
218-
{"@timestamp": "2020-12-07T11:06:07.000Z", "event": { "category": "process", "id": "cMyt5SZ2", "sequence": 3 }, "process": { "pid": 2012, "name": "cmd.exe", "executable": "C:\\\\Windows\\\\System32\\\\cmd.exe" } }
218+
{"@timestamp": "2099-12-07T11:06:07.000Z", "event": { "category": "process", "id": "cMyt5SZ2", "sequence": 3 }, "process": { "pid": 2012, "name": "cmd.exe", "executable": "C:\\\\Windows\\\\System32\\\\cmd.exe" } }
219219
{"index":{}}
220-
{"@timestamp": "2020-12-07T11:07:08.000Z", "event": { "category": "file", "id": "bYA7gPay", "sequence": 4 }, "file": { "accessed": "2020-12-07T11:07:08.000Z", "name": "cmd.exe", "path": "C:\\\\Windows\\\\System32\\\\cmd.exe", "type": "file", "size": 16384 }, "process": { "pid": 2012, "name": "cmd.exe", "executable": "C:\\\\Windows\\\\System32\\\\cmd.exe" } }
220+
{"@timestamp": "2099-12-07T11:07:09.000Z", "event": { "category": "process", "id": "aR3NWVOs", "sequence": 4 }, "process": { "pid": 2012, "name": "regsvr32.exe", "command_line": "regsvr32.exe /s /u /i:https://...RegSvr32.sct scrobj.dll", "executable": "C:\\\\Windows\\\\System32\\\\regsvr32.exe" }}
221221
{"index":{}}
222-
{"@timestamp": "2020-12-07T11:07:09.000Z", "event": { "category": "process", "id": "aR3NWVOs", "sequence": 5 }, "process": { "pid": 2012, "name": "regsvr32.exe", "executable": "C:\\\\Windows\\\\System32\\\\regsvr32.exe" }}
222+
{"@timestamp": "2099-12-07T11:07:10.000Z", "event": { "category": "file", "id": "tZ1NWVOs", "sequence": 5 }, "process": { "pid": 2012, "name": "regsvr32.exe", "executable": "C:\\\\Windows\\\\System32\\\\regsvr32.exe" }, "file": { "path": "C:\\\\Windows\\\\System32\\\\scrobj.dll", "name": "scrobj.dll" }}
223223
{"index":{}}
224-
{"@timestamp": "2020-12-07T11:07:10.000Z", "event": { "category": "process", "id": "GTSmSqgz0U", "sequence": 6, "type": "termination" }, "process": { "pid": 2012, "name": "regsvr32.exe", "executable": "C:\\\\Windows\\\\System32\\\\regsvr32.exe" }}'''
224+
{"@timestamp": "2099-12-07T11:07:10.000Z", "event": { "category": "process", "id": "GTSmSqgz0U", "sequence": 6, "type": "termination" }, "process": { "pid": 2012, "name": "regsvr32.exe", "executable": "C:\\\\Windows\\\\System32\\\\regsvr32.exe" }}'''
225225

226226
buildRestTests.setups['host'] = '''
227227
# Fetch the http host. We use the host of the master because we know there will always be a master.

‎docs/reference/eql/eql-search-api.asciidoc‎

Lines changed: 36 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -490,17 +490,17 @@ Original JSON body passed for the event at index time.
490490
===== Basic query example
491491

492492
The following EQL search request searches for events with an `event.category` of
493-
`file` that meet the following conditions:
493+
`process` that meet the following conditions:
494494

495-
* A `file.name` of `cmd.exe`
495+
* A `process.name` of `cmd.exe`
496496
* An `process.pid` other than `2013`
497497

498498
[source,console]
499499
----
500500
GET /my-index-000001/_eql/search
501501
{
502502
"query": """
503-
file where (file.name == "cmd.exe" and process.pid != 2013)
503+
process where (process.name == "cmd.exe" and process.pid != 2013)
504504
"""
505505
}
506506
----
@@ -532,52 +532,38 @@ the events in ascending, lexicographic order.
532532
{
533533
"_index": "my-index-000001",
534534
"_type": "_doc",
535-
"_id": "fwGeywNsBl8Y9Ys1x51b",
535+
"_id": "babI3XMBI9IjHuIqU0S_",
536536
"_score": null,
537537
"_source": {
538-
"@timestamp": "2020-12-06T11:04:07.000Z",
538+
"@timestamp": "2099-12-06T11:04:05.000Z",
539539
"event": {
540-
"category": "file",
541-
"id": "dGCHwoeS",
542-
"sequence": 2,
543-
},
544-
"file": {
545-
"accessed": "2020-12-07T11:07:08.000Z",
546-
"name": "cmd.exe",
547-
"path": "C:\\Windows\\System32\\cmd.exe",
548-
"type": "file",
549-
"size": 16384
540+
"category": "process",
541+
"id": "edwCRnyD",
542+
"sequence": 1
550543
},
551544
"process": {
545+
"pid": 2012,
552546
"name": "cmd.exe",
553-
"executable": "C:\\Windows\\System32\\cmd.exe",
554-
"pid": 2012
547+
"executable": "C:\\Windows\\System32\\cmd.exe"
555548
}
556549
}
557550
},
558551
{
559552
"_index": "my-index-000001",
560553
"_type": "_doc",
561-
"_id": "AtOJ4UjUBAAx3XR5kcCM",
554+
"_id": "b6bI3XMBI9IjHuIqU0S_",
562555
"_score": null,
563556
"_source": {
564-
"@timestamp": "2020-12-07T11:07:08.000Z",
557+
"@timestamp": "2099-12-07T11:06:07.000Z",
565558
"event": {
566-
"category": "file",
567-
"id": "bYA7gPay",
568-
"sequence": 4
569-
},
570-
"file": {
571-
"accessed": "2020-12-07T11:07:08.000Z",
572-
"name": "cmd.exe",
573-
"path": "C:\\Windows\\System32\\cmd.exe",
574-
"type": "file",
575-
"size": 16384
559+
"category": "process",
560+
"id": "cMyt5SZ2",
561+
"sequence": 3
576562
},
577563
"process": {
564+
"pid": 2012,
578565
"name": "cmd.exe",
579-
"executable": "C:\\Windows\\System32\\cmd.exe",
580-
"pid": 2012
566+
"executable": "C:\\Windows\\System32\\cmd.exe"
581567
}
582568
}
583569
}
@@ -586,8 +572,8 @@ the events in ascending, lexicographic order.
586572
}
587573
----
588574
// TESTRESPONSE[s/"took": 6/"took": $body.took/]
589-
// TESTRESPONSE[s/"_id": "fwGeywNsBl8Y9Ys1x51b"/"_id": $body.hits.events.0._id/]
590-
// TESTRESPONSE[s/"_id": "AtOJ4UjUBAAx3XR5kcCM"/"_id": $body.hits.events.1._id/]
575+
// TESTRESPONSE[s/"_id": "babI3XMBI9IjHuIqU0S_"/"_id": $body.hits.events.0._id/]
576+
// TESTRESPONSE[s/"_id": "b6bI3XMBI9IjHuIqU0S_"/"_id": $body.hits.events.1._id/]
591577

592578
[[eql-search-api-sequence-ex]]
593579
===== Sequence query example
@@ -651,49 +637,50 @@ shared `process.pid` value for each matching event.
651637
"_type": "_doc",
652638
"_id": "AtOJ4UjUBAAx3XR5kcCM",
653639
"_version": 1,
654-
"_seq_no": 3,
640+
"_seq_no": 1,
655641
"_primary_term": 1,
656642
"_score": null,
657643
"_source": {
658-
"@timestamp": "2020-12-07T11:07:08.000Z",
644+
"@timestamp": "2099-12-06T11:04:07.000Z",
659645
"event": {
660646
"category": "file",
661-
"id": "bYA7gPay",
662-
"sequence": 4
647+
"id": "dGCHwoeS",
648+
"sequence": 2
663649
},
664650
"file": {
665-
"accessed": "2020-12-07T11:07:08.000Z",
651+
"accessed": "2099-12-07T11:07:08.000Z",
666652
"name": "cmd.exe",
667653
"path": "C:\\Windows\\System32\\cmd.exe",
668654
"type": "file",
669655
"size": 16384
670656
},
671-
"process": {
657+
"process": {
658+
"pid": 2012,
672659
"name": "cmd.exe",
673-
"executable": "C:\\Windows\\System32\\cmd.exe",
674-
"pid": 2012
660+
"executable": "C:\\Windows\\System32\\cmd.exe"
675661
}
676662
}
677663
},
678664
{
679665
"_index": "my-index-000001",
680666
"_type": "_doc",
681-
"_id": "yDwnGIJouOYGBzP0ZE9n",
667+
"_id": "OQmfCaduce8zoHT93o4H",
682668
"_version": 1,
683-
"_seq_no": 4,
669+
"_seq_no": 3,
684670
"_primary_term": 1,
685671
"_score": null,
686672
"_source": {
687-
"@timestamp": "2020-12-07T11:07:09.000Z",
673+
"@timestamp": "2099-12-07T11:07:09.000Z",
688674
"event": {
689675
"category": "process",
690676
"id": "aR3NWVOs",
691-
"sequence": 5
677+
"sequence": 4
692678
},
693-
"process": {
679+
"process": {
680+
"pid": 2012,
694681
"name": "regsvr32.exe",
695-
"executable": "C:\\Windows\\System32\\regsvr32.exe",
696-
"pid": 2012
682+
"command_line": "regsvr32.exe /s /u /i:https://...RegSvr32.sct scrobj.dll",
683+
"executable": "C:\\Windows\\System32\\regsvr32.exe"
697684
}
698685
}
699686
}
@@ -705,4 +692,4 @@ shared `process.pid` value for each matching event.
705692
----
706693
// TESTRESPONSE[s/"took": 6/"took": $body.took/]
707694
// TESTRESPONSE[s/"_id": "AtOJ4UjUBAAx3XR5kcCM"/"_id": $body.hits.sequences.0.events.0._id/]
708-
// TESTRESPONSE[s/"_id": "yDwnGIJouOYGBzP0ZE9n"/"_id": $body.hits.sequences.0.events.1._id/]
695+
// TESTRESPONSE[s/"_id": "OQmfCaduce8zoHT93o4H"/"_id": $body.hits.sequences.0.events.1._id/]

0 commit comments

Comments
 (0)