Asset-based TQL queries

Helix Enterprise analyzes organizational-level assets (or entities) such as users and hosts to identify potential insider threats. This detects behavior anomalies by these assets, creates detections, and alerts the system immediately. The assets are attached to event data for the incoming Helix Enterprise alerts.

Index Search in the Helix Enterprise Web UI has keys such as assets and asset_type that allow you to build a search query. You can hover over or click the assets field in Search Results to view nested fields such as asset_id, asset_name, and asset_uuid and then use the values that are returned in subsequent searches.

Examples

The following examples queries return events with assets.

All events with users correlated to physical devices:

assets.event_fields:username | groupby hostname

All events with the field "username" grouped by individual user names:

assets.event_fields:username | groupby username

All events with the asset alias "win7hxagent":

assets.asset_alias:"win7hxagent"

All events with the asset name "user04":

assets.asset_name="user04"

All events with assets grouped by asset ID:

| groupby assets.asset_id

All events with the class "fireeye_nx_alert":

has(assets) AND class=fireeye_nx_alert

All events with a username field:

has(assets, username)