File tree 2 files changed +15
-15
lines changed 2 files changed +15
-15
lines changed Original file line number Diff line number Diff line change @@ -695,17 +695,17 @@ until [ process where event.type == "stop" ]
695
695
====
696
696
697
697
[discrete]
698
- [[eql-runs-keyword ]]
699
- === `runs` keyword
698
+ [[eql-with- runs-statement ]]
699
+ === `with runs` statement
700
700
701
- Use a `runs` statement to run the same event criteria successively within a
701
+ Use a `with runs` statement to run the same event criteria successively within a
702
702
sequence query. For example:
703
703
704
704
[source,eql]
705
705
----
706
706
sequence
707
707
[ process where event.type == "creation" ]
708
- [ library where process.name == "regsvr32.exe" ] [ runs=3]
708
+ [ library where process.name == "regsvr32.exe" ] with runs=3
709
709
[ registry where true ]
710
710
----
711
711
@@ -721,17 +721,16 @@ sequence
721
721
[ registry where true ]
722
722
----
723
723
724
- A `runs` statement must be enclosed in square brackets (`[ ]`). The `runs` value
725
- must be between `1` and `100` (inclusive).
724
+ The `runs` value must be between `1` and `100` (inclusive).
726
725
727
- You can use a `runs` statement with the <<eql-by-keyword,`by` keyword>>. For
728
- example:
726
+ You can use a `with runs` statement with the <<eql-by-keyword,`by` keyword>>.
727
+ For example:
729
728
730
729
[source,eql]
731
730
----
732
731
sequence
733
732
[ process where event.type == "creation" ] by process.executable
734
- [ library where process.name == "regsvr32.exe" ] by dll.path [ runs=3]
733
+ [ library where process.name == "regsvr32.exe" ] by dll.path with runs=3
735
734
----
736
735
737
736
[discrete]
Original file line number Diff line number Diff line change @@ -30,11 +30,12 @@ Other versions:
30
30
31
31
// tag::notable-highlights[]
32
32
[discrete]
33
- === EQL: `runs` keyword for repeated events
33
+ === EQL: `with runs` statements for repeated events
34
34
35
- In 7.16, we added the `runs` keyword to EQL sequence queries. Sometimes you want
36
- to find a sequence that contains an event multiple times in succession. Rather
37
- than type the same event criteria multiple times, you can use a `runs` statement
38
- to declare the criteria once and run it successively. For more details, check
39
- out the {ref}/eql-syntax.html#eql-runs-keyword[EQL syntax documentation].
35
+ In 7.16, we added the `with runs` statement syntax to EQL sequence queries.
36
+ Sometimes you want to find a sequence that contains an event multiple times in
37
+ succession. Rather than type the same event criteria multiple times, you can use
38
+ a `with runs` statement to declare the criteria once and run it successively.
39
+ For more details, check out the
40
+ {ref}/eql-syntax.html#eql-with-runs-statement[EQL syntax documentation].
40
41
// end::notable-highlights[]
You can’t perform that action at this time.
0 commit comments