We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
1 parent 745f527 commit eca0401Copy full SHA for eca0401
docs/reference/eql/functions.asciidoc
@@ -1015,10 +1015,6 @@ expressions. Matching is case-sensitive.
1015
*Example*
1016
[source,eql]
1017
----
1018
-// The two following expressions are equivalent.
1019
-process.name == "*regsvr32*" or process.name == "*explorer*"
1020
-wildcard(process.name, "*regsvr32*", "*explorer*")
1021
-
1022
// process.name = "regsvr32.exe"
1023
wildcard(process.name, "*regsvr32*") // returns true
1024
wildcard(process.name, "*regsvr32*", "*explorer*") // returns true
0 commit comments