TQL supports searches used to monitor user and service account activities that occur outside normal working hours. Such activities include logging in to systems, connecting to VPNs, accessing files and records, and adding users to security-enabled groups.
Every Helix Enterprise event includes an event_epoch field with the following time elements. You can use these elements in TQL queries to filter events based on time or date.
|
|
The event_epoch field is populated by the following event timestamps, in descending order: eventtime, eventtimeutc, detectedtime, detectedtimeutc. The timestamps are displayed in the event details in the Helix Enterprise Web UI.
Note
If an event has none of these timestamps, the
event_epochfield is populated by themeta_tstimestamp, which records when Helix Enterprise received the event.
The epochtime_field time element shows which timestamp populated the event_epoch field. To view all time element values, hover over or click event_epoch in the event details.
Examples
metaclass:windows eventid=4732 event_epoch.hour>2 event_epoch.hour<10
Shows when a member is added to a Windows security-enabled group inside the specified 7-hour window (3:00–9:59 UTC).
class=trellix_audit eventtype=search event_epoch.weekday=["Saturday","Sunday"] | groupby username
Shows when and by whom Helix Enterprise searches are run on weekends.
class=appliance_health status=crit event_epoch.hour>16 | groupby [devicename,deviceid]
Shows when critical health events occur on appliances during the specified period (17:00–23:59 UTC).