The following TQL queries can be used for alerts.
Trellix Helix alerts
class=alerts | table [id, risk, message]
Trellix Helix alert kill chain mapping
class=intel_hit intelwhitelisted=false intel_context.observable_analysis_conclusion="malicious" has:intel_context.observable_threat_actors | groupby [intel_context.observable_threat_actors,intel_context.observable_malware_families] | table [meta_rts,intelmatchclass,srcipv4,intel_matches,action,intel_context.observable_labels,intel_context.observable_malware_families,intel_context.observable_threat_actors]
Intel hits associated with known malware families
class=intel_hit intelwhitelisted=false intel_context.observable_analysis_conclusion="malicious" has:intel_context.observable_malware_families | groupby [intel_context.observable_threat_actors,intel_context.observable_malware_families] | table [meta_rts,intelmatchclass,srcipv4,intel_matches,action,intel_context.observable_labels,intel_context.observable_malware_families,intel_context.observable_threat_actors]
FireEye Alert JSON for domain IOC
class:fireeye_* eventlog=malware-object explanation.malware-detected.malware.domain="<DOMAIN VALUE>"
FireEye alert JSON for hash IOC
class:fireeye_* eventlog=malware-object explanation.malware-detected.malware.md5sum="<HASH VALUE>"
FireEye alerts by class and detection type
class:fireeye_* has:virus | groupby [class,virus]