The following are basic TQL queries.
All available classes
| groupby [class]
All available classes and log source
| groupby [class,rawmsghostname]
Network Security Evidence Collector event categories
class=fireeye_nx | groupby eventtype
Connection-based activity
metaclass=connection | groupby class
HTTP-based activity
metaclass:http_proxy | groupby class
Classes of events associated with a single connection by ID
has:connectionid connectionid="<CONNECTION ID>" | groupby [class]
Large files sent out
sentipbytes>250000 | groupby count | table [meta_ts, class, duration, srcipv4, srccountrycode, dstipv4, dstcountrycode, dstport, sentbytes, rcvdbytes] | sort > sentbytes
All software identified by bro_software, with no blank entries
class:bro_software not content=(null)/(null) ((null)) not content=(empty) | table content |groupby content | sort < content
Java only as an example
class:bro_software application:"java" | table [srcipv4, content]
File Analysis Framework events
class:fireeye_faf | groupby application