EQL

EQL, the Event Query Language, is a query language in Elastic for ordered sequences of events, such as a process start followed by a network connection from the same host. In Elastic Security it backs event correlation rules. It is how a rule says this then that within a window.

What EQL means here

A sequence needs a join key and a time limit. EQL states both in the query, so the rule describes an attack chain instead of a single event.

Sigma's Elasticsearch backend can convert to EQL, so a Sigma correlation rule can reach Elastic through that path.

Example of EQL in Sigma and pySigma documentation

The Sigma backends page says the Elasticsearch backend converts to Lucene, ES|QL with correlations and EQL queries. sigmahq.io read 2026-11-03

Terms related to EQL

• ES|QL: ES|QL is Elastic's piped query language for filtering, transforming and analysing data.
• Sigma: Sigma is an open YAML format for describing log-based detections once, so converters can turn them into queries for different SIEMs.
• Detection rule: A detection rule is a stored query or logic that runs over security data and raises an alert when it matches.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.