Trellix Query Language (TQL) is a data analysis language used in queries to retrieve events for further analysis.
The following shows the high-level anatomy of a TQL query.
<filter section> | <transform section>
The filter section is specified to the left of the pipe; the transform section of the query is specified to the right of the pipe.
All fields and values are lowercase.
Important
TQL supports an unlimited nesting of queries; however, performance may slow down depending on the result set.
Filter section
The filter section consists of search clauses. Search clauses include regular (including parenthetical) expressions. These expressions usually take the format of a field-value pair. They identify the data using exact matches, comparisons, ranges, and expressions.
Transform section
The transform section consists of transform clauses. Transform clauses allow you to modify the way the query results are returned and displayed. They are separated from the rest of the TQL query by a pipe symbol (|).
Note
The transform section supports only Sorting.
| sort > time | sort < time