DQL

Detection Query Language

DQL (Detection Query Language) allows performing detailed queries on log fields to find specific patterns.

Example

data.win.system.eventID:1 AND data.win.eventdata.originalFileName:FileCoAuth.exe

Tips

• Enable All Level when wanting to scan across all rule levels.
• Combine filter (Organization / Office / Agent / Time) to limit scope and speed up query.
• Use wildcards or regex according to engine capability when needing pattern matching.