$ soctoys query-builder
Describe a hunt once — get it for nine platforms. Splunk SPL, Microsoft KQL (Defender & Sentinel), Cortex XSIAM XQL, Elastic ES|QL, Kibana KQL, CrowdStrike LogScale, Google SecOps YARA-L, QRadar AQL and a Sigma rule, with counts, distinct counts, time buckets and thresholds. Your saved hunts stay in this browser.