This section describes EQL structure, syntax, and semantics.
Query overview
An EQL query contains one or more semicolon-delimited statements.
Statements and clauses
EQL queries consist of statements. Statements, in their turn, can contain several types of clauses.
Grouping and aggregation
In EQL, aggregation operations bucket a set of records into a resulting set of aggregated records.
Expressions
Expressions are typically combinations of one or more functions, attributes, constants, or operators. Most expressions are simple combinations of functions and attributes.