A doubt with ElasticSearch Integration and EQL searches (es-eql-search)

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

A doubt with ElasticSearch Integration and EQL searches (es-eql-search)

L1 Bithead

Hi everyone,


I'm currently working on how to make some EQL queries to my Elastic Instance from Cortex XSOAR. I'm using ElasticSearch integration, specifically the command "es-eql-search" which purposoe, I guess, is to make a EQL query to ElasticSearch API. However, regarding to the XSOAR documentation related to the Elastic's integrations, I can see that "Query" parameter has to be in Lucene Syntax... and that not makes sense because we "can't" transform an EQL query to a Lucene Query.


Im trying to make an EQL query like:

process where process.name == "svchost.exe"

But it seems that it not works and every parameters seems to be right.


Any suggestions?


Update: I confirm that my query runs ok. But there's a problem with the results. I cant load query hits to the context. If the output is too big, a file is returned...if not, the output is returned as a results that I can only view through another window. Is there a solution to load the output in the context? (Quiet mode: off) (I tried to ExtendContext too and it not works :S)

Cortex XSOAR 



L3 Networker

In this case, I would recommend maybe writing something custom using our API core that would make the call and put the result in the context or maybe even a file that could be used by the playbook. 

Information about our API: https://cortex.marketplace.pan.dev/marketplace/details/DemistoRESTAPI/

  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!