mirror of
https://github.com/elastic/elasticsearch.git
synced 2025-04-25 07:37:19 -04:00
bb0d0ed6dd
Resolves /security-docs/https://github.com/elastic/security-docs/issues/6430. Removes an outdated admonition.
(cherry picked from commit 63074d8e70)
Co-authored-by: Benjamin Ironside Goldstein <91905639+benironside@users.noreply.github.com>
36 lines
1.3 KiB
Text
36 lines
1.3 KiB
Text
[[esql-elastic-security]]
|
|
=== Using {esql} in {elastic-sec}
|
|
|
|
++++
|
|
<titleabbrev>Using {esql} in {elastic-sec}</titleabbrev>
|
|
++++
|
|
|
|
You can use {esql} in {elastic-sec} to investigate events in Timeline and create
|
|
detection rules. Use the Elastic AI Assistant to build {esql} queries, or answer
|
|
questions about the {esql} query language.
|
|
|
|
[discrete]
|
|
[[esql-elastic-security-timeline]]
|
|
=== Use {esql} to investigate events in Timeline
|
|
|
|
You can use {esql} in Timeline to filter, transform, and analyze event data
|
|
stored in {es}. To start using {esql}, open the **{esql}** tab. To learn
|
|
more, refer to {security-guide}/timelines-ui.html#esql-in-timeline[Investigate
|
|
events in Timeline].
|
|
|
|
[discrete]
|
|
[[esql-elastic-security-detection-rules]]
|
|
=== Use {esql} to create detection rules
|
|
|
|
Use the {esql} rule type to create detection rules using {esql} queries. The
|
|
{esql} rule type supports aggregating and non-aggregating queries. To learn
|
|
more, refer to {security-guide}/rules-ui-create.html#create-esql-rule[Create an
|
|
{esql} rule].
|
|
|
|
[discrete]
|
|
[[esql-elastic-security-ai-assistant]]
|
|
=== Elastic AI Assistant
|
|
|
|
Use the Elastic AI Assistant to build {esql} queries, or answer questions about
|
|
the {esql} query language. To learn more, refer to
|
|
{security-guide}/security-assistant.html[AI Assistant].
|