Simple definition
Event Query Language; a query language used to search and correlate event sequences in security and observability platforms.
EQL is especially useful for behavioral analytics where a single event is not enough. Detection engineers can describe ordered activity across a time window and group related events by an entity such as a host, user, or process.
What can EQL express?
Event filters
Match event categories, field values, processes, users, hosts, files, networks, or other attributes.
Sequences
Describe ordered activity where one event should be followed by another event or set of events.
Correlation keys
Associate sequence steps with the same host, user, process, or another shared identifier.
Time boundaries
Constrain behavioral sequences to a meaningful time window.
Conditions
Combine field comparisons and logical conditions to narrow suspicious activity.
Hunting logic
Use event-oriented queries interactively before turning validated logic into a production detection.
Why EQL matters in detection engineering
- Many attacker behaviors are better represented as sequences than as one isolated event.
- Entity-aware correlation reduces false matches between unrelated users, hosts, or processes.
- Event-oriented syntax can make behavioral intent easier to review than long source-specific search expressions.
- Portable analytic ideas still depend on correct normalized fields and event categories.
- Testing is necessary because missing telemetry or inconsistent timestamps can break sequence logic.
- EQL can support both threat hunting and production detection when the query is validated against real data.
How EQL works
Define the behavior
Describe the threat hypothesis, ATT&CK behavior, or activity pattern the query should identify.
Identify event data
Confirm which event categories, fields, timestamps, and entities are available.
Build the query
Write event filters or an ordered sequence using the appropriate correlation key.
Run against representative data
Validate expected matches and inspect benign activity that also satisfies the logic.
Tune the analytic
Adjust filters, entity grouping, timing, and exclusions without creating unnecessary gaps.
Operationalize
Deploy the validated logic as a hunt, detection rule, migration artifact, or reusable analytic.
EQL concepts detection engineers should understand
Event category
A consistent event classification helps queries work across sources.
Sequence
An ordered set of events representing a multi-step behavior.
Correlation key
A field or entity used to ensure sequence steps belong to the same subject.
Maximum span
A time boundary prevents unrelated events far apart in time from being joined.
Field mapping
Query quality depends on source data being mapped to the expected fields and semantics.
Validation
Queries should be tested with positive, negative, and edge-case event examples.
Common EQL cybersecurity use cases
Process behavior
Correlate process creation, parent-child behavior, file activity, and execution sequences.
Identity activity
Detect suspicious authentication followed by privilege or account changes.
File activity
Search for sequences involving file creation, modification, and execution.
Network activity
Connect process or endpoint events with outbound network behavior.
Threat hunting
Explore event patterns interactively before promoting them into detection content.
Detection migration
Use behavioral logic as an intermediate analytic when moving between platforms or schemas.
EQL vs KQL vs SPL
| Language | Primary use | Typical strength |
|---|---|---|
| EQL | Search and correlate event-oriented security data. | Behavioral sequences and entity-aware event correlation. |
| KQL | Query large security and telemetry datasets in Microsoft and Kusto-based analytics environments. | Flexible filtering, aggregation, joins, time-series analysis, and security hunting. |
| SPL | Search and analyze data in Splunk. | Broad event search, statistics, transformations, correlation, dashboards, and detections. |
Key technical considerations
Normalize fields correctly
Queries should use fields whose source semantics are understood and consistent.
Validate timestamps
Sequence order depends on reliable event time and ingestion behavior.
Choose stable entity keys
A weak join key can combine unrelated activity or split one real sequence.
Handle missing fields
Some sources may not populate every field required by a reusable query.
Keep test cases
Regression tests help catch parser and schema changes that alter query behavior.
Watch query cost
Large time ranges and broad sequence logic can create expensive searches on high-volume datasets.
Benefits and common problems
Benefits
- Natural expression of multi-event behavior.
- Useful for behavioral detections and hunting.
- Entity-aware sequence correlation.
- Readable analytic logic for review.
- Strong fit for event-centric security data.
Common problems
- Required event categories are not populated consistently.
- Sequence keys are unstable or missing.
- Time windows are too broad or too narrow.
- Converted logic is assumed to behave identically across platforms.
- Queries are deployed without representative testing.
How ForshTec helps with EQL and detection engineering
ForshTec helps security teams connect telemetry, field mappings, EQL logic, ATT&CK behavior, testing, and production detection workflows.
- EQL query development and review
- Event-category and field mapping
- Sequence and entity-correlation design
- Detection validation and tuning
- SIEM migration and query translation
- ATT&CK and use-case mapping
Need EQL queries that work against your actual security data?
ForshTec can map the required telemetry, build and test the event logic, and operationalize it as repeatable detection content.
Talk to ForshTecFAQs
What does EQL stand for?
EQL stands for Event Query Language.
What is EQL used for?
It is used to search event data and correlate sequences of related activity for threat hunting, security analytics, and detection engineering.
Why are sequences useful in EQL?
Many suspicious behaviors are defined by multiple ordered events rather than one event in isolation.
How does EQL correlate events?
Sequence logic can group related steps by a shared entity or field such as a host, user, or process, depending on the available schema.
Is EQL the same as KQL?
No. They are different query languages with different syntax and platform ecosystems, although both are used for security analytics.
What makes an EQL detection reliable?
Correct data mapping, stable entity fields, accurate timestamps, representative tests, and careful tuning are all important.