{"id":9725,"library":"eql","title":"EQL (Event Query Language) Python Library","description":"EQL (Event Query Language) is a high-level query language from Microsoft for expressing relationships between events, primarily used in security analytics and threat hunting contexts. The Python library provides tools to parse, validate, and transform EQL queries into an Abstract Syntax Tree (AST). The current stable version is 1.0.0, with releases typically tied to feature enhancements or bug fixes, maintaining a stable API.","status":"active","version":"1.0.0","language":"python","source_language":"en","source_url":"https://github.com/microsoft/eql","tags":["security","threat-hunting","query-language","parser","ast","microsoft"],"install":[{"cmd":"pip install eql","lang":"bash","label":"Install stable version"}],"dependencies":[{"reason":"Required for parsing EQL syntax into an AST.","package":"ply","optional":false}],"imports":[{"wrong":"from eql import parse","symbol":"parse","correct":"from eql import parse"}],"quickstart":{"code":"import eql\n\n# Define a simple EQL query string\neql_query_string = \"process where eventid == 1 and process_name == 'powershell.exe'\"\n\n# Parse the EQL query string into an EQL Query object (AST)\nparsed_query = eql.parse(eql_query_string)\n\nprint(f\"Original EQL: {eql_query_string}\")\nprint(f\"Parsed Query Type: {type(parsed_query)}\")\nprint(f\"Parsed Query (JSON representation): {parsed_query.to_json(indent=2)}\")\n\n# The parsed_query object can then be transformed or evaluated by an external engine.","lang":"python","description":"This quickstart demonstrates how to parse a basic EQL query string using the `eql.parse()` function. The function returns an `eql.Query` object, which represents the Abstract Syntax Tree (AST) of the query. This object can then be inspected or used as input for an EQL execution engine (which is not part of this library)."},"warnings":[{"fix":"Understand that `eql.parse()` returns an AST. Integrate this AST with an external EQL evaluation engine or implement your own event processing logic.","message":"The `eql` Python library is primarily an EQL *parser* and AST generator. It does NOT include an event processing or execution engine to run queries against live event streams or data lakes. You will need to implement or integrate with a separate system to evaluate the parsed queries.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Always refer to the official EQL specification or documentation for correct syntax. Use a linter or formatter if available. Common errors include missing quotes around strings or incorrect logical operators.","message":"EQL syntax is strict and unforgiving. Even minor typos, incorrect casing for keywords (e.g., `where` vs `WHERE`), or unsupported constructs will lead to parsing errors.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Ensure `ply` is installed correctly. If conflicts arise, consider using a dedicated virtual environment or checking for version compatibility issues with other libraries.","message":"The library relies on the `ply` (Python Lex-Yacc) package for parsing. While generally robust, conflicts can arise if other dependencies in your project require a significantly different version of `ply`, or if there are environment-specific issues during `ply`'s installation or operation.","severity":"gotcha","affected_versions":"All versions"},{"fix":"Rigorously validate your EQL queries against the actual schema of your event data. Implement schema validation in your EQL execution pipeline.","message":"EQL queries are highly dependent on the schema of the events they are intended to query. Queries referencing non-existent fields or fields with incorrect data types will lead to logical errors or runtime failures in the *execution engine*, not necessarily during parsing.","severity":"gotcha","affected_versions":"All versions"}],"env_vars":null,"search_vec":"'1.0.0':57 'abstract':48 'analyt':29 'api':71 'ast':51,80 'bug':66 'context':33 'current':53 'enhanc':64 'eql':1,7,44 'event':2,8,24 'express':21 'featur':63 'fix':67 'high':14 'high-level':13 'hunt':32,75 'languag':4,10,17,78 'level':15 'librari':6,36 'maintain':68 'microsoft':19,81 'pars':40 'parser':79 'primarili':25 'provid':37 'python':5,35 'queri':3,9,16,45,77 'query-languag':76 'relationship':22 'releas':59 'secur':28,72 'stabl':54,70 'syntax':49 'threat':31,74 'threat-hunt':73 'tie':61 'tool':38 'transform':43 'tree':50 'typic':60 'use':26 'valid':41 'version':55","created_at":"2026-04-17T01:20:24.300229+00:00","updated_at":"2026-04-17T01:20:24.300229+00:00","problems":{"verify_error":"Traceback (most recent call last):\n  File \"<string>\", line 1, in <module>\nImportError: cannot import name 'parse' from 'eql' (/tmp/tmps02m_l6q/venv/lib/python3.12/site-packages/eql/__init__.py). Did you mean: 'parser'?"},"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":"1.0.0","cli_name":"eql","cli_version":"eql 1.0.0","type":"library","homepage":"https://eql.readthedocs.io","github":null,"docs":null,"changelog":null,"pypi":"https://pypi.org/project/eql/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["data","serialization"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"import_fail","verified_at":"2026-07-03","last_verified":"2026-07-03","next_check":"2026-07-10","install_tag":null}}