SIEM Tool -- Query Translator
SIEM Query Translator
Translate detection queries between Splunk SPL, Microsoft Sentinel KQL, IBM QRadar AQL and Elastic EQL. Handles field filters, time ranges, aggregations and common SOC patterns. Not a compiler -- a practical translation aid for migration and cross-platform work.
→
Load example:
Translation coverage
Supported patterns
- Field equality / inequality filters
- Wildcard / contains matching
- Time range filters
- Boolean AND / OR / NOT logic
- Count, sum, avg, max aggregations
- Group by / stats operations
- EventID / event code filters
- Common field name mappings (src_ip, dest_ip, user, process_name)
Limitations
- Complex eval / extend expressions need manual review
- Join / lookup operations are platform-specific
- Regex patterns may need syntax adjustment
- Platform-specific functions (spath, rex, parse) require manual translation
- Always validate translated queries in a test environment