Welcome to the public knowledge-ground to bootstrap your expertise for hunting and thriving with MVISION EDR Real Time Search - RTS.

In this section we provide practical reasons and examples of baseline queries practitioners adopt for learning the environment they are defending.

We are aiming to relate our query examples with public domain resources like SANS, or research from individual security professionals in the community.

In the code blocks, we are providing the query syntax, you can copy/paste into your Real Time Search - RTS.

Throughout the content, we build from basic to more elaborate queries.

This repo is broken down by category of collectors in each section, and the table below represents how to find/associate queries to use-cases.

The table below serves as the initial orientation of the McAfee Real Time Search (RTS) language.

Practitioners can find practical a how-to for MVISION Collectors and advance their needs for unique threat hunts applicable to their needs.

Below you can see the format of this guide. We will expose the question (need) in bold and the query used to answer the question.

HostInfo connection_status, hostname, ip_address, platform

HostInfo connection_status, hostname, ip_address, platform
    WHERE HostInfo connection_status equals "Online"

HostInfo connection_status, hostname, ip_address, platform
    WHERE HostInfo connection_status equals "Online"
        AND HostInfo platfom not equals "Windows"