Skip to content

Commit 691a546

Browse files
jrodewigjrodewig
authored
[DOCS] EQL: Shorten response snippets (#72330) (#72335)
Shortens several lengthy response snippets to better highlight the relevant parts.
1 parent 74a729a commit 691a546

File tree

2 files changed

+29
-126
lines changed

2 files changed

+29
-126
lines changed

‎docs/reference/eql/detect-threats-with-eql.asciidoc‎

Lines changed: 6 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -155,10 +155,7 @@ This fits the behavior of a Squiblydoo attack.
155155
[source,console-result]
156156
----
157157
{
158-
"is_partial": false,
159-
"is_running": false,
160-
"took": 21,
161-
"timed_out": false,
158+
...
162159
"hits": {
163160
"total": {
164161
"value": 1,
@@ -199,7 +196,7 @@ This fits the behavior of a Squiblydoo attack.
199196
}
200197
}
201198
----
202-
// TESTRESPONSE[s/"took": 21/"took": $body.took/]
199+
// TESTRESPONSE[s/ \.\.\.\n/"is_partial": false, "is_running": false, "took": $body.took, "timed_out": false,/]
203200
// TESTRESPONSE[s/"_index": ".ds-my-data-stream-2099.12.07-000001"/"_index": $body.hits.events.0._index/]
204201
// TESTRESPONSE[s/"_id": "gl5MJXMBMk1dGnErnBW8"/"_id": $body.hits.events.0._id/]
205202

@@ -225,10 +222,7 @@ The query matches an event, confirming `scrobj.dll` was loaded.
225222
[source,console-result]
226223
----
227224
{
228-
"is_partial": false,
229-
"is_running": false,
230-
"took": 5,
231-
"timed_out": false,
225+
...
232226
"hits": {
233227
"total": {
234228
"value": 1,
@@ -259,7 +253,7 @@ The query matches an event, confirming `scrobj.dll` was loaded.
259253
}
260254
}
261255
----
262-
// TESTRESPONSE[s/"took": 5/"took": $body.took/]
256+
// TESTRESPONSE[s/ \.\.\.\n/"is_partial": false, "is_running": false, "took": $body.took, "timed_out": false,/]
263257
// TESTRESPONSE[s/"_index": ".ds-my-data-stream-2099.12.07-000001"/"_index": $body.hits.events.0._index/]
264258
// TESTRESPONSE[s/"_id": "ol5MJXMBMk1dGnErnBW8"/"_id": $body.hits.events.0._id/]
265259

@@ -299,10 +293,7 @@ The query matches a sequence, indicating the attack likely succeeded.
299293
[source,console-result]
300294
----
301295
{
302-
"is_partial": false,
303-
"is_running": false,
304-
"took": 25,
305-
"timed_out": false,
296+
...
306297
"hits": {
307298
"total": {
308299
"value": 1,
@@ -403,7 +394,7 @@ The query matches a sequence, indicating the attack likely succeeded.
403394
}
404395
}
405396
----
406-
// TESTRESPONSE[s/"took": 25/"took": $body.took/]
397+
// TESTRESPONSE[s/ \.\.\.\n/"is_partial": false, "is_running": false, "took": $body.took, "timed_out": false,/]
407398
// TESTRESPONSE[s/"_index": ".ds-my-data-stream-2099.12.07-000001"/"_index": $body.hits.sequences.0.events.0._index/]
408399
// TESTRESPONSE[s/"_id": "gl5MJXMBMk1dGnErnBW8"/"_id": $body.hits.sequences.0.events.0._id/]
409400
// TESTRESPONSE[s/"_id": "ol5MJXMBMk1dGnErnBW8"/"_id": $body.hits.sequences.0.events.1._id/]

‎docs/reference/eql/eql.asciidoc‎

Lines changed: 23 additions & 111 deletions
Original file line numberDiff line numberDiff line change
@@ -171,15 +171,9 @@ sequences.
171171
[source,console-result]
172172
----
173173
{
174-
"is_partial": false,
175-
"is_running": false,
176-
"took": 60,
177-
"timed_out": false,
174+
...
178175
"hits": {
179-
"total": {
180-
"value": 1,
181-
"relation": "eq"
182-
},
176+
"total": ...,
183177
"sequences": [
184178
{
185179
"events": [
@@ -228,7 +222,8 @@ sequences.
228222
}
229223
}
230224
----
231-
// TESTRESPONSE[s/"took": 60/"took": $body.took/]
225+
// TESTRESPONSE[s/ \.\.\.\n/"is_partial": false, "is_running": false, "took": $body.took, "timed_out": false,/]
226+
// TESTRESPONSE[s/"total": \.\.\.,/"total": { "value": 1, "relation": "eq" },/]
232227
// TESTRESPONSE[s/"_index": ".ds-my-data-stream-2099.12.07-000001"/"_index": $body.hits.sequences.0.events.0._index/]
233228
// TESTRESPONSE[s/"_id": "OQmfCaduce8zoHT93o4H"/"_id": $body.hits.sequences.0.events.0._id/]
234229
// TESTRESPONSE[s/"_id": "yDwnGIJouOYGBzP0ZE9n"/"_id": $body.hits.sequences.0.events.1._id/]
@@ -286,70 +281,22 @@ The `hits.sequences.join_keys` property contains the shared field values.
286281
[source,console-result]
287282
----
288283
{
289-
"is_partial": false,
290-
"is_running": false,
291-
"took": 60,
292-
"timed_out": false,
293-
"hits": {
294-
"total": {
295-
"value": 1,
296-
"relation": "eq"
297-
},
284+
...
285+
"hits": ...,
298286
"sequences": [
299287
{
300288
"join_keys": [
301289
2012
302290
],
303-
"events": [
304-
{
305-
"_index": ".ds-my-data-stream-2099.12.07-000001",
306-
"_id": "OQmfCaduce8zoHT93o4H",
307-
"_source": {
308-
"@timestamp": "2099-12-07T11:07:09.000Z",
309-
"event": {
310-
"category": "process",
311-
"id": "aR3NWVOs",
312-
"sequence": 4
313-
},
314-
"process": {
315-
"pid": 2012,
316-
"name": "regsvr32.exe",
317-
"command_line": "regsvr32.exe /s /u /i:https://...RegSvr32.sct scrobj.dll",
318-
"executable": "C:\\Windows\\System32\\regsvr32.exe"
319-
}
320-
}
321-
},
322-
{
323-
"_index": ".ds-my-data-stream-2099.12.07-000001",
324-
"_id": "yDwnGIJouOYGBzP0ZE9n",
325-
"_source": {
326-
"@timestamp": "2099-12-07T11:07:10.000Z",
327-
"event": {
328-
"category": "file",
329-
"id": "tZ1NWVOs",
330-
"sequence": 5
331-
},
332-
"process": {
333-
"pid": 2012,
334-
"name": "regsvr32.exe",
335-
"executable": "C:\\Windows\\System32\\regsvr32.exe"
336-
},
337-
"file": {
338-
"path": "C:\\Windows\\System32\\scrobj.dll",
339-
"name": "scrobj.dll"
340-
}
341-
}
342-
}
343-
]
291+
"events": ...
344292
}
345293
]
346294
}
347295
}
348296
----
349-
// TESTRESPONSE[s/"took": 60/"took": $body.took/]
350-
// TESTRESPONSE[s/"_index": ".ds-my-data-stream-2099.12.07-000001"/"_index": $body.hits.sequences.0.events.0._index/]
351-
// TESTRESPONSE[s/"_id": "OQmfCaduce8zoHT93o4H"/"_id": $body.hits.sequences.0.events.0._id/]
352-
// TESTRESPONSE[s/"_id": "yDwnGIJouOYGBzP0ZE9n"/"_id": $body.hits.sequences.0.events.1._id/]
297+
// TESTRESPONSE[s/ \.\.\.\n/"is_partial": false, "is_running": false, "took": $body.took, "timed_out": false,/]
298+
// TESTRESPONSE[s/"hits": \.\.\.,/"hits": { "total": { "value": 1, "relation": "eq" },/]
299+
// TESTRESPONSE[s/"events": \.\.\./"events": $body.hits.sequences.0.events/]
353300

354301
Use the <<eql-until-keyword,`until` keyword>> to specify an expiration
355302
event for sequences. Matching sequences must end before this event.
@@ -456,15 +403,9 @@ hit.
456403
[source,console-result]
457404
----
458405
{
459-
"is_partial": false,
460-
"is_running": false,
461-
"took": 60,
462-
"timed_out": false,
406+
...
463407
"hits": {
464-
"total": {
465-
"value": 2,
466-
"relation": "eq"
467-
},
408+
"total": ...,
468409
"events": [
469410
{
470411
"_index": ".ds-my-data-stream-2099.12.07-000001",
@@ -496,41 +437,16 @@ hit.
496437
]
497438
}
498439
},
499-
{
500-
"_index": ".ds-my-data-stream-2099.12.07-000001",
501-
"_id": "xLkCaj4EujzdNSxfYLbO",
502-
"fields": {
503-
"process.name": [
504-
"regsvr32.exe"
505-
],
506-
"process.name.keyword": [
507-
"regsvr32.exe"
508-
],
509-
"@timestamp": [
510-
"4100324830000"
511-
],
512-
"event.type": [
513-
"termination"
514-
],
515-
"process.executable.keyword": [
516-
"C:\\Windows\\System32\\regsvr32.exe"
517-
],
518-
"process.pid": [
519-
2012
520-
],
521-
"process.executable": [
522-
"C:\\Windows\\System32\\regsvr32.exe"
523-
]
524-
}
525-
}
440+
....
526441
]
527442
}
528443
}
529444
----
530-
// TESTRESPONSE[s/"took": 60/"took": $body.took/]
445+
// TESTRESPONSE[s/ \.\.\.\n/"is_partial": false, "is_running": false, "took": $body.took, "timed_out": false,/]
446+
// TESTRESPONSE[s/"total": \.\.\.,/"total": { "value": 2, "relation": "eq" },/]
531447
// TESTRESPONSE[s/"_index": ".ds-my-data-stream-2099.12.07-000001"/"_index": $body.hits.events.0._index/]
532448
// TESTRESPONSE[s/"_id": "OQmfCaduce8zoHT93o4H"/"_id": $body.hits.events.0._id/]
533-
// TESTRESPONSE[s/"_id": "xLkCaj4EujzdNSxfYLbO"/"_id": $body.hits.events.1._id/]
449+
// TESTRESPONSE[s/ \.\.\.\.\n/$body.hits.events.1/]
534450

535451
[discrete]
536452
[[eql-use-runtime-fields]]
@@ -569,15 +485,9 @@ The API returns:
569485
[source,console-result]
570486
----
571487
{
572-
"is_partial": false,
573-
"is_running": false,
574-
"took": 60,
575-
"timed_out": false,
488+
...
576489
"hits": {
577-
"total": {
578-
"value": 2,
579-
"relation": "eq"
580-
},
490+
"total": ...,
581491
"events": [
582492
{
583493
"_index": ".ds-my-data-stream-2099.12.07-000001",
@@ -591,15 +501,17 @@ The API returns:
591501
]
592502
}
593503
},
594-
...
504+
....
595505
]
596506
}
597507
}
598508
----
599-
// TESTRESPONSE[s/"took": 60/"took": $body.took/]
509+
// TESTRESPONSE[s/ \.\.\.\n/"is_partial": false, "is_running": false, "took": $body.took, "timed_out": false,/]
510+
// TESTRESPONSE[s/"total": \.\.\.,/"total": { "value": 2, "relation": "eq" },/]
600511
// TESTRESPONSE[s/"_index": ".ds-my-data-stream-2099.12.07-000001"/"_index": $body.hits.events.0._index/]
601512
// TESTRESPONSE[s/"_id": "OQmfCaduce8zoHT93o4H"/"_id": $body.hits.events.0._id/]
602-
// TESTRESPONSE[s/\.\.\./$body.hits.events.1/]
513+
// TESTRESPONSE[s/ \.\.\.\.\n/$body.hits.events.1/]
514+
603515

604516
[discrete]
605517
[[specify-a-timestamp-or-event-category-field]]

0 commit comments

Comments
 (0)