From fdb660f5162f08cefce57ff34e2f013da943f16f Mon Sep 17 00:00:00 2001 From: James Rodewig <40268737+jrodewig@users.noreply.github.com> Date: Tue, 1 Dec 2020 10:16:06 -0500 Subject: [PATCH] [DOCS] EQL: Remove outdated wildcard ref --- docs/reference/eql/functions.asciidoc | 4 ---- 1 file changed, 4 deletions(-) diff --git a/docs/reference/eql/functions.asciidoc b/docs/reference/eql/functions.asciidoc index a3e707c6891c5..8d0f1a6da3644 100644 --- a/docs/reference/eql/functions.asciidoc +++ b/docs/reference/eql/functions.asciidoc @@ -1015,10 +1015,6 @@ expressions. Matching is case-sensitive. *Example* [source,eql] ---- -// The two following expressions are equivalent. -process.name == "*regsvr32*" or process.name == "*explorer*" -wildcard(process.name, "*regsvr32*", "*explorer*") - // process.name = "regsvr32.exe" wildcard(process.name, "*regsvr32*") // returns true wildcard(process.name, "*regsvr32*", "*explorer*") // returns true