meta data for this page
  •  

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Next revision		Previous revision
soc:tools:kibana [2026/06/10 09:15] – created titannetsoc:tools:kibana [2026/06/10 12:57] (current) – titannet
Line 1: Line 1:
 ====== Kibana ====== ====== Kibana ======
 +
 +===== Query Basics =====
  
  
Line 6: Line 8:
  
  
-==== Regex ====+ 
 +==== Lucene ====
  
   - Turn off KQL to use the Lucene query syntax   - Turn off KQL to use the Lucene query syntax
 +
 +=== Fuzzy ===
 +
 +| ''fu~~y'' | fuzzy operator |
 +| ''"server error"~4'' | "slop value" -> server and error up to 4 positions apart |
 +
 +
 +
 +
 +=== Regex ===
 +
  
 <code> <code>
Line 14: Line 28:
 Description: /(s|m).*/ Description: /(s|m).*/
 </code> </code>
 +
 +==== EQL ====
 +
 +<code>
 +file where host.os.type == "linux" and
 + event.action in ("rename", "creation") and
 + file.path in (
 +   "/etc/crontab",
 +   "/etc/cron.allow",
 +   "/etc/cron.deny"
 + )
 +
 +</code>
 +
 +===== Quicksheets =====
 +
 +==== Http/s ====
 +
 +<code>
 +client.ip
 +user.agent
 +http.request.method
 +url.path
 +http.response.status_code
 +</code>
 +
 +
 +