Press CTRL+K to open search

Sample TQL search queries

  • Published on Aug 26, 2026
  • 1 minute(s) read
Prev Next

Query description

TQL search query example

File Name (Regex)

"fileAttributes.name:/.*daily.*/"

File Name

"fileAttributes.name:shanya_crypter.exe"

Command Line

"cmdLine:/.*GUP.exe.*/ AND cmdLine:/.*-dexmb25nic6n25sclnf44rrgynq.*/"

Destination IP

"network.dstIp:'10.194.0.191'"

Destination Port

"network.dstPort:'9090'"

Source IP

"network.srcIp:'10.26.21.225'"

Multiple Network Fields

"network.dstIp:'10.194.0.191' network.dstPort:'9090'"

DNS Name (Regex)

"dns.name:/.*glcloud.*/"

Process and Command Line

"cmdLine:/.*conhost.exe.*/ processName:con*"

Related articles
  • Create a real-time search query using syntax
    Endpoint Detection and Response with Forensics (EDRF) > Investigate potential threats with EDRF > Conduct searches > Search real-time data of endpoints for investigation and threat hunting
  • Create a real-time search query using syntax
    Endpoint Detection and Response (EDR) > Endpoint Detection and Response Product Guide > Searching endpoints data for investigation and threat hunting > Search real-time data of endpoints for investigation and threat hunting
  • Set notations
    Endpoint Detection and Response with Forensics (EDRF) > EDRF On-prem > EDRF On-prem installation > Historical Search Module > Anatomy of a TQL query > Searches > Syntax elements