EQL (Event Query Language) is a high-level query language from Microsoft for expressing relationships between events, primarily used in security analytics and threat hunting contexts. The Python library provides tools to parse, validate, and transform EQL queries into an Abstract Syntax Tree (AST). The current stable version is 1.0.0, with releases typically tied to feature enhancements or bug fixes, maintaining a stable API.
pip install eqlVerified import paths — ran on the pinned version, not inferred.
This quickstart demonstrates how to parse a basic EQL query string using the `eql.parse()` function. The function returns an `eql.Query` object, which represents the Abstract Syntax Tree (AST) of the query. This object can then be inspected or used as input for an EQL execution engine (which is not part of this library).
Understand that `eql.parse()` returns an AST. Integrate this AST with an external EQL evaluation engine or implement your own event processing logic.
Always refer to the official EQL specification or documentation for correct syntax. Use a linter or formatter if available. Common errors include missing quotes around strings or incorrect logical operators.
Ensure `ply` is installed correctly. If conflicts arise, consider using a dedicated virtual environment or checking for version compatibility issues with other libraries.
Rigorously validate your EQL queries against the actual schema of your event data. Implement schema validation in your EQL execution pipeline.