# What is Helix and some example about Index Search Inside Data Lake

\\

<figure><img src="https://www.alirodoplu.com/wp-content/uploads/2023/04/FireEye-Helix1.jpg" alt="" width="563"><figcaption><p><em>https://www.cyberworld.com.hk/product/fireeye-helix/</em></p></figcaption></figure>

Trellix Helix(formerly FireEye Helix) is Trellix’s XDR solution. It collects the logs it collects from many source&#x73;*(endpoints, cloud, email, networ, data)* in its own data lake and allows us to perform advanced searches on the data lake fed from these various sources. These searches can deliver the data we want among millions, even billions of events, in a very short time.Helix uses ***MQL (Mandiant Query Language)*** language when making these searches.

<figure><img src="https://www.alirodoplu.com/wp-content/uploads/2023/04/marketecture-vect.png" alt="" width="563"><figcaption><p><em>https://www.trellix.com/en-us/products/helix.html</em></p></figcaption></figure>

Let’s do some index searches in Helix’s data lake.

**Index Searched Examples**

<figure><img src="https://www.alirodoplu.com/wp-content/uploads/2023/04/image-33-1024x408.png" alt=""><figcaption></figcaption></figure>

This is where we will do our searches.

**Example 0(Attack example)**

<figure><img src="https://www.alirodoplu.com/wp-content/uploads/2023/04/image-42.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://www.alirodoplu.com/wp-content/uploads/2023/04/image-43-1024x179.png" alt=""><figcaption></figcaption></figure>

The reason I say Example 0 is because it is not an introductory example, but rather an interesting ***attack example*** to keep our attention warm.\
In this example, it is the MQL we wrote to fetch events whose metaclass is http proxy, which has user agent information, and whose user agent is not mozilla, but which fits the regex pattern I gave.\
\&#xNAN;***This is not a user agent string, but a Bash Shellshock exploit code snippet that attempts to exploit a vulnerability in the Bash shell, allowing an attacker to execute arbitrary code on the target system.The exploit code defines a Bash function with the name of a Bash environment variable, and then calls that function with the content “/bin/cat /etc/passwd”.***

\
**Example 1**\
MQL query written to fetch all events with “***Google***” in them.

<figure><img src="https://www.alirodoplu.com/wp-content/uploads/2023/04/image-34-1024x467.png" alt=""><figcaption></figcaption></figure>

**Trick1:** If we type *domain:google.com* in the search field, it will bring up events with “google.com” in the domain field.\
**Trick2:** If we search for *domain=google.com* it will only return events equal to “google.com”

**Example 2**\
Negate the result using “NOT” or “!”

<figure><img src="https://www.alirodoplu.com/wp-content/uploads/2023/04/image-37.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://www.alirodoplu.com/wp-content/uploads/2023/04/image-38.png" alt="" height="183" width="557"><figcaption></figcaption></figure>

<figure><img src="https://www.alirodoplu.com/wp-content/uploads/2023/04/image-39-1024x135.png" alt=""><figcaption></figcaption></figure>

**Example 3**\
Let’s write an MQL query that returns events containing *infophp.php* in the uri information using wildcard(\*).

<figure><img src="https://www.alirodoplu.com/wp-content/uploads/2023/04/image-40.png" alt="" height="158" width="455"><figcaption></figcaption></figure>

<figure><img src="https://www.alirodoplu.com/wp-content/uploads/2023/04/image-41-1024x188.png" alt=""><figcaption></figcaption></figure>

**Example 4**\
I actually wanted it to search among network events by selecting the event type as flow, and then I wanted it to bring me events with more than 20000 packets sent.

<figure><img src="https://www.alirodoplu.com/wp-content/uploads/2023/04/image-44.png" alt="" height="121" width="562"><figcaption></figcaption></figure>

<figure><img src="https://www.alirodoplu.com/wp-content/uploads/2023/04/image-45-1024x197.png" alt=""><figcaption></figcaption></figure>

**Example 6**\
In this example, we wrote the MQL query that groups the events with the event type http and the http method delete according to their domain names and returns their numbers.

<figure><img src="https://www.alirodoplu.com/wp-content/uploads/2023/04/image-46.png" alt="" height="112" width="650"><figcaption></figcaption></figure>

<figure><img src="https://www.alirodoplu.com/wp-content/uploads/2023/04/image-49-1024x299.png" alt=""><figcaption></figcaption></figure>

As can be seen in the screenshot, by grouping the domains, we were able to get the information on which domain the http delete operation was performed more.\\

**Example 7**

We can also create our own table view according to the column information we want.

<figure><img src="https://www.alirodoplu.com/wp-content/uploads/2023/04/image-50.png" alt="" height="169" width="833"><figcaption></figcaption></figure>

<figure><img src="https://www.alirodoplu.com/wp-content/uploads/2023/04/image-51-1024x277.png" alt=""><figcaption></figcaption></figure>

Here is the table view we wrote

***

As a result, we performed easy and various searches on the Helix XDR product of Trellix, using the MQL language on the Data lake, which is fed from multiple sources. The results of these searches return to us very quickly and offer us many visualization options.\\

Stay tuned for my other articles.
