[1] [CITE@en-us[EQL search | Elasticsearch Guide '''['''8.11''']''' | Elastic]], [TIME[2023-11-24T15:19:39.000Z]], [TIME[2023-11-25T09:01:45.976Z]] <https://www.elastic.co/guide/en/elasticsearch/reference/current/eql.html>


[2] [[ECS][Elastic Common Schema]]