Added documentation about PATH value type helpers #3703 (#4141)

log2timeline · Jun 12, 2022 · 9172034 · 9172034
1 parent 8bc93f9
commit 9172034
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/docs/sources/user/Event-filters.md b/docs/sources/user/Event-filters.md
@@ -111,6 +111,22 @@ DATETIME(0)
 DATETIME("2020-12-23T12:34:56.789")
 ```
 
+### Path value helper
+
+The path helper is:
+```
+PATH(str)
+```
+
+It allows to check a path on a per path segment basis.
+
+For example the path helper:
+```
+path contains PATH('bin')
+```
+
+Will match `/usr/bin` and `/usr/local/bin` but not `/usr/local/sbin`.
+
 ## References
 
 * [log2timeline filtering 101](http://blog.kiddaland.net/2012/12/log2timeline-filtering-101.html)