join is used to link unordered events that may share properties. This is
sequence, but lacks time constraints.
- Basic structure
join // by shared_field1, shared_field2, ... [event_type1 where condition1] // by field1 [event_type2 where condition2] // by field2 ... [event_typeN where conditionN] // by field3
This is useful when identifying multiple connections between two network endpoints with different ports.
join, events can happen in any order, and when all events match, the
join is completed.
join by source_ip, destination_ip [network where destination_port == 3389] // RDP [network where destination_port == 135] // RPC [network where destination_port == 445] // SMB
Like sequences, events can also be joined
until an expiration event is met.
For instance, it may be useful to identify processes with registry, network, and file activity.
join by pid [process where true] [network where true] [registry where true] [file where true] until [process where event_subtype_full == "termination_event"]