Reflex Query Language (RQL)

Reflex Query Language (RQL) is a query language designed to query events within Case-Hub. RQL is used while creating Event Rules to query the Event data and match certain criteria.

Event Fields

  • observables|observables.*

  • value

  • tlp

  • tags

  • spotted

  • safe

  • source_field

  • data_type

  • ioc

  • original_source_field

  • title

  • description

  • tlp

  • severity

  • status,

  • reference

  • source

  • signature

  • tags

  • raw_log|raw_log.*

Supported Expressions

The following Expressions are used to compare target field data to intended data:

Expression
Description
Example

RegExp

The item has a value that matches a regular expression

title RegExp "^Event.*"

In

The item has a value in a list of values

observables.tags.name in ["malware"]

Contains

The target value contains a specific string

description Contains "malware"

ContainsCIS

Same as Contains but will make the target value and checked value the same case

=|eq|Eq

Equal to (strings or numbers)

!=|ne|Ne|NE

Not equal to (strings or numbers)

>|gt

Greater than (> or gt)

>=|gte

Greater than or equal to (>= or gte)

<|lt

Less than (< or lt)

<=|lte

Less than or equal to (<= or lte)

InCIDR

The IP address is in a specific CIDR network

192.168.1.1 InCIDR 192.168.0.0/16

Is

Use for boolean operations like "Is True"

ioc Is True

Exists

The field exists at all, useful if you don't care what the target value

Between

The item has a value between a given range

tlp Between "1,3"

StartsWith

The item has a value that starts with a certain string

url StartsWith "https"

EndsWith

The item has a value that ends with a certain string

domain EndsWith ".tk"

Expand

When you want two conditions on a nested object to be true use each statement.

For example, The observable 127.0.0.1 should have a value of 127.0.0.1 and safe is True, the query would look like Expand observables (value = "127.0.0.1" and safe Is True)

Intel|Threat

Allows RQL to check the value of a field against a Case-Hub Intel List (threat lists)

Not

The expression within this block should not match. Note: Can only be used on eq, in, InCIDR, contains, between AND regexp.

title Not Eq "Suspicious DNS Query"

Note that the Items that don't have a specified field may match a Not expression e.g. ip NOT InCIDR "192.168.0.0/16" may match on an event not having an ip field, pair this with ip exists AND ip NOT InCIDR "192.168.0.0/16"

Mutators

Mutators take a field and perform an extra operation on it to make it digestible by the downstream comparison. Assume you want to find any Event with a domain observable where the length of the domain is longer than 20 characters

  • |length - How long a string is e.g. url.domain|length > 20

  • |count - The number of items in an array value observables|count > 2

  • |lowercase - Lowercase a string (redundant for ContainsCIS but can be used for other fields)

  • |refang - If for some reason the target value has been defanged, think hXXps[:]// instead of https:// this will refang the value to perform a proper comparison e.g. url.full|refang eq "https://www.google.com"

  • |b64decode - If the target value is base64 encoded and you want to write rules using the terms within it, first base64 decode it, e.g. command|b64decode Contains "Invoke-Mimikatz"

  • |b64extract - Will attempt to find base64 encoded data in a string and extract it for comparison later in the query e.g. an event contains a command powershell -encodedCommand SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AaQBwAGkAbgBmAG8ALgBpAG8ALwBpAHAA would extract and decode SQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AaQBwAGkAbgBmAG8ALgBpAG8ALwBpAHAA to Invoke-WebRequest https://www.ipinfo.io/ip. An analyst could then use a query like command|b64extract Contains "ipinfo.io"

  • |urldecode - Unescapes an escaped URL so that direct comparisons can be made

  • |any - Force the following condition to match any item in the array (Can only be used on Contains and In expressions)

  • |all - Force the condition to match all items in the array (Can only be used on Contains and In expressions)

  • |avg - Calculates the average value given a list of values e.g. observables.risk_score|avg > 7

  • |max - Finds the max value given a list of values e.g. vulnerablities.cvss_score|max > 7

  • |min - Finds the minimum value given a list of values

  • |sum - Add up all the values in a list of integer or float values

  • |split - Splits a string that contains spaces into an array

  • |geo_country - Returns the ISO Code for the country an IP resides in

  • |geo_continent - Returns the ISO Code for the content an IP resides in

  • |geo_timezone - Returns the timezone an IP resides in

  • |reverse_lookup - Takes an IP and attempts to return the associated hostname

  • |nslookup_a - Fetches the A record for a domain name

  • |nslookup_aaaa - Fetches the AAAA record for a domain name

  • |nslookup_mx - Fetches the MX records for a domain name

  • |nslookup_ns - Fetches the NS records for a domain name

  • |nslookup_ptr- Fetches the PTR records for a domain

  • |is_private - Returns True if an IP is RFC1918

  • |is_global - Returns True if an IP is routable on the internet

  • |is_multicast - Returns True if an IP is multicast

  • |is_ipv6 - Returns True if an IP is IPv6

Query Examples

# Match any Suspicious DNS query only if it came from the Administrator on a domain joined machine and the target observable is evil.com
title = "Suspicious DNS Query" and user Contains "Administrator" and hostname EndsWith "ad.blusapphire.com" and (observables.data_type = "domain" and observables.value = "evil.com")
# Match any cases referencing malware or with a severity higher than 3
description Contains "malware" or severity > 3
# Match any event that has a domain with evil.com or an IP with 127.0.0.1
(observables.data_type = "domain" and observables.value = "evil.com") or (observables.data_type = "ip" and observables.value = "127.0.0.1")
# Match any Event that has all of the below observables
observables.values|all in ["evil.com","blusapphire.com"]
# Match any event that contains a base64 encoded command that once decoded contains the following phrases
command exists and command|b64decode|lowercase Contains ["invoke-mimikatz","invoke-bloodhound","invoke-powerdump","invoke-kerberoast"]
# Match any suspicious DNS query for a specific domain that originates from a specific user and source process 
# Should always be this event title
title = "Suspicious DNS Query"

# Observables should always exist
and observables exists

# Brian must be the source user of the event
and expand observables (value Contains "Brian" and source_field|lowercase = "winlog.event_data.user")

# And the DNS resolution should always be for netwars-support.slack.com
and expand observables (value = "netwars-support.slack.com" and source_field|lowercase = "dns.question.name")

# And should originate from Slack
and raw_log.process.executable EndsWith "slack.exe"
# Check to see if the user in the event is in the Allowed Users intel list
expand observables ( data_type = "user" and intel(value|uppercase, 'Allowed Users'))

PreviousEvent-RulesNextInput Configuration

Last updated