Turn a log line into Microsoft Sentinel KQL
Paste a raw log → get an AI-suggested KQL search, explained.
Paste a raw log line and get an AI-suggested Microsoft Sentinel search. The query uses your log's own fields — verify it in your environment before relying on it.
The KQL is AI-suggested — a starting point. It uses your log's own field names and a the table table you confirm. Always verify before running it in production.
What This Does
- Detects the log format from the line
- Extracts the log's own fields (extend/parse/parse_json)
- Suggests a KQL search to find similar events
- Adds broad + precise alternative queries
- Pulls out IOCs and a pivot time window
- Know your real table — it's a labeled guess
- Confirm your table — verify it against your data
- Guarantee the KQL is correct or complete
- See your environment's parsed fields
- Run the discovery query first
- Confirm the guessed table
- Test in a non-production search
Nothing is stored or logged. Indicators (IPs — including internal ranges — domains, URLs, hashes, emails, CVE IDs, and usernames/hostnames in labeled fields) are detected on our server with deterministic pattern-matching before the model is called — no AI is used for that step. The full line is then sent to the AI model to build the KQL search and is not saved — there are no share URLs and no account is required.
Paste a raw log line
A single syslog line, a Windows 4625 event, an Apache access line, a Cisco ASA deny, a JSON or CEF record. The format is detected automatically.
AI drafts the KQL
The model extracts the fields the log actually contains and builds a primary search plus broad and precise alternatives — grounded in those field names.
Verify in your environment
Run the included discovery query to list your real tables, confirm the guessed table, and validate the search before relying on it.
Log → Splunk (SPL)
Same tool for Splunk: paste a raw log and get an AI-suggested SPL search, explained.
IOC Reputation Checker
Check any IP, domain, hash, or URL extracted from your log against 14+ threat intelligence sources.
All Free Tools
Browse the full set of free DFIR tools — IOC checks, domain lookups, phishing analysis, and more.
Building detections at scale?
The DFIR Platform adds private enrichment, detection-rule management, and API access — results never leave your workspace. Free tier includes credits to get started.