funnel

Analyze conversion through sequential steps. Track user journeys and attack progressions.

Description

The funnel command analyzes how entities progress through a series of ordered steps within a time window. It calculates conversion rates between steps, identifying where entities drop off or complete the full sequence.

This is useful for analyzing user workflows, attack kill chains, and multi-stage processes.

Syntax

... | funnel by <field> [, <field> ...] window=<duration> step1=<expr> step2=<expr> [step3=<expr> ...]

Required Arguments

by
Fields to partition by (e.g., session_id, user, src_ip)

window
Syntax: window=<duration>
Description: Maximum time to complete all steps

steps
Syntax: step1=<expr> step2=<expr> ...
Description: Ordered steps with search expressions

Examples

Login to action funnel

* | funnel by user window=1h
    step1=(event_type="login")
    step2=(event_type="file_access")
    step3=(event_type="data_export")

Attack kill chain

* | funnel by src_ip window=24h
    step1=(event_type="reconnaissance")
    step2=(event_type="initial_access")
    step3=(event_type="execution")
    step4=(event_type="persistence")
    step5=(event_type="exfiltration")

User onboarding

* | funnel by user window=7d
    step1=(event_type="account_created")
    step2=(event_type="first_login")
    step3=(event_type="profile_completed")
    step4=(event_type="first_transaction")

Phishing campaign

* | funnel by user window=48h
    step1=(event_type="email_received" subject CONTAINS "urgent")
    step2=(event_type="email_opened")
    step3=(event_type="link_clicked")
    step4=(event_type="credentials_entered")

API workflow

* | funnel by session_id window=5m
    step1=(endpoint="/api/auth")
    step2=(endpoint="/api/user/profile")
    step3=(endpoint="/api/data/query")

Malware execution chain

* | funnel by src_host window=30m
    step1=(event_type="file_download" file_type="executable")
    step2=(event_type="file_execution")
    step3=(event_type="registry_modification")
    step4=(event_type="network_connection")

Usage Notes

Step counts: Each step reports the count of entities that reached it or later. Derive conversion between steps from these counts.

Drop-off analysis: dropper_count and dropper_top_attrs show where entities fail to progress and which attributes the droppers share.

Order required: Steps must occur in specified order within time window.

Partial completion: Entities completing some but not all steps are tracked.

Output Fields

One row per declared step, ordered by funnel_level:

• funnel_level - Stage index (1-based)
• step_name - Name of the step
• count - Number of entities that reached this step or later
• dropper_count - Entities that stopped at this step
• dropper_median_idle_s - Median idle time (seconds) before dropping off
• dropper_top_attrs - Top field values among droppers, each with count and pct

Related Commands

• sequence - Detect ordered patterns
• transaction - Group related events
• stats - Aggregate funnel results