Asset-based TQL queries

Trellix Helix analyzes organizational-level assets (or entities) such as users and hosts to identify potential insider threats. This detects behavior anomalies by these assets, creates detections, and alerts the system immediately. The assets are attached to event data for the incoming Trellix Helix alerts.

Index Search in the Trellix Helix Web UI has keys such as assets and asset_type that allow you to build a search query. You can hover over or click the assets field in Search Results to view nested fields such as asset_id, asset_name, and asset_uuid and then use the values that are returned in subsequent searches.

Examples

The following examples queries return events with assets.

All events with users correlated to physical devices:

assets.event_fields:username | groupby hostname

All events with the field "username" grouped by individual user names:

assets.event_fields:username | groupby username

All events with the asset alias "win7hxagent":

assets.asset_alias:"win7hxagent"

All events with the asset name "user04":

assets.asset_name="user04"

All events with assets grouped by asset ID:

| groupby assets.asset_id

All events with the class "fireeye_nx_alert":

has(assets) AND class=fireeye_nx_alert

All events with a username field:

has(assets, username)