Event Query Language (EQL)
A tool for advanced HTTPD logfile security analysis and forensics, implementing various techniques to detect attacks against web applications.
Explore the EQL Analytics Library Integrated with Elasticsearch
Explore a library of EQL analytics that is now natively integrated into Elasticsearch, following Endgame's collaboration with Elastic. The EQL feature in Elasticsearch is designed to support non-security users, with updates detailed in the Elasticsearch EQL documentation. To get started, install the EQL module using Python versions 2.7 or 3.5 and above. After installation, you can try using a sample JSON file and test it with EQL commands.
