Event Query Language (EQL) for Opensearch

[saeed-mcu]

Event Query Language (EQL) is a query language for event-based time series data, such as logs, metrics, and traces. Is there any way , I can use EQL in opensearch for searching logs ?

Something like EQL search in ElasticSearch. It is very useful for security analytics and Correlation rule.

[msfroh]

Have you looked at PPL: https://opensearch.org/docs/latest/search-plugins/sql/ppl/syntax/ ?

[saeed-mcu]

Hi @msfroh , thanks for your answer. I've seen PPL before but that's not what I talked about. In EQL, there are many functions and expressions that are very useful in attack detection and without them it is not possible

For example, the following EQL is meant to match a sequence of events that:

• Share the same user.name field values
• Occur within 15m (15 minutes) of the first matching event

  sequence by user.name with maxspan=15m
  [ file where file.extension == "exe" ]
  [ process where true ]

[macohen]

@anirudha any thoughts on this proposal?

[msfroh]

@opensearch-project/admin -- Can we please reassign this to the opensearch-project/sql repository? The requested capability sounds like something that should be supported by PPL. Thanks