The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Bro FTP TQL queries

Published on Sep 9, 2026

1 minute(s) read

Prev Next

The following TQL queries are Bro FTP queries.

Identify the most frequent FTP accounts

class:bro_ftp | groupby username 100

Identify the most frequent FTP account and IP address pairs

class:bro_ftp | groupby [username,srcipv4,dstipv4] 100

Was this article helpful?