Interactive tool // Detection Engineering

SIEM Query Builder.

28 detections mapped to MITRE ATT&CK, each written three ways at once — Splunk SPL, Microsoft Sentinel KQL, and IBM QRadar AQL — with your filters (user, host, IP, port, time window) filled in live.

MITRE ATT&CK
Splunk
Sentinel
QRadar

How this works

Search or browse the detections below, then fill in whichever filters apply (time window, affected user, source IP, and so on — fields that don’t apply to the selected detection dim out automatically). Each platform's query updates live, with a one-click copy. The syntax cheat sheet tab maps the core query operations across all three languages side by side.

Search detections, categories or MITRE IDs

Time window

Threshold / limit

Affected user

Affected system

Source IP

Destination IP / target

Destination port

Command line, process or domain contains

Show

Assumes Windows Security/Sysmon, Defender for Endpoint tables, CEF firewall logs, DNS and O365/Azure sources. Rename indexes, tables and QRadar custom properties (for example “EventID”) to match your environment, and test AQL against your DSMs. Dimmed fields don’t apply to the selected detection and are ignored.