Skip to content

Add support for repeated sequences under elasticsearch_syntax #57

@brokensound77

Description

@brokensound77

New Feature Description

Recently, repeated sequences merged into elasticsearch EQL, which will require updates to support this.

Ex:

sequence
  [process where opcode == 1] by unique_pid
  [file where opcode == 0] by unique_pid with runs=2
  [network where opcode == 0] by unique_pid

Metadata

Metadata

Assignees

Labels

elasticsearchRelates to the EQL in Elasticsearch effort

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions