Where communities thrive


  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
People
Activity
    Ross Wolf
    @rw-access
    If you're new to EQL, you might find our Getting Started blog post or the online query guide helpful
    Braxton Williams
    @buddytex
    @rw-access Do you have plans to add DNS events to eqllib and the mapping for sysmon DNS?
    Ross Wolf
    @rw-access
    hey @buddytex thanks for the reminder.
    definitely, yes. and original_file_name for process events
    can you open an issue on https://github.com/endgameinc/eql/issues/new/choose? we can track there and get the conversation going to pick what makes sense for the fields. I'm thinking of skipping the usual subtype since a lot of solutions like sysmon merge the request with the response
    Braxton Williams
    @buddytex
    @rw-access Submitted an issue for both of those
    Ross Wolf
    @rw-access
    nice. thanks!
    Ross Wolf
    @rw-access
    PR for original_file_name here endgameinc/eqllib#19