EQL Analytics Library
A library of event-based analytics written in EQL to detect adversary behaviors identified in MITRE ATT&CK, providing detection rules for the Elastic Stack.
A library of event-based analytics written in EQL to detect adversary behaviors identified in MITRE ATT&CK, providing detection rules for the Elastic Stack.
Checked October 2026.
The EQL Analytics Library (eqllib) is a collection of event-based analytics written in Event Query Language (EQL) designed to detect adversary behaviors identified in the MITRE ATT&CK framework.
The library provides detection rules in multiple query languages including EQL, KQL (Kibana Query Language), and Lucene, making it compatible with the Elastic Stack ecosystem.
These analytics are specifically crafted to identify tactics, techniques, and procedures (TTPs) used by threat actors as documented in the MITRE ATT&CK knowledge base.
The library has been integrated into the Detection Engine of Kibana, allowing security teams to leverage pre-built detection rules for threat hunting and security monitoring activities.
The rules focus on event-based detection, analyzing security events and logs to identify suspicious patterns and behaviors that may indicate adversary activity within an environment.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about EQL Analytics Library: features, pricing and alternatives.
EQL Analytics Library is a product in the Detection Engineering category. It covers MITRE ATT&CK and Detection Rules.
EQL Analytics Library is free. Download and setup instructions are at https://github.com/endgameinc/eqllib/.
Alternatives to EQL Analytics Library listed on CybersecTools:
Compare all EQL Analytics Library alternatives at https://cybersectools.com/alternatives/eql-analytics-library
EQL Analytics Library is available as a cloud service. It is listed for small businesses, mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
A .Net wrapper library for the native Yara library with interoperability and portability features.
Dorothy is a tool to test monitoring and detection capabilities for Okta environments, with modules mapped to MITRE ATT&CK® tactics.
Signature-based YARA rules for detecting and preventing threats within Linux, Windows, and macOS systems.
A testing tool that generates suspect actions to validate and test Falco runtime security monitoring rulesets.
An open source tool that generates YARA rules from installed software on running operating systems for efficient software identification in digital forensic investigations.
A repository of officially managed detection rules for the Falco runtime security monitoring system that identifies threats, abnormal behaviors, and compliance violations through syscall and container event analysis.
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,032 products.
Connect your AI
