KQL / SPL Query Library

Curated KQL (Microsoft Sentinel/Defender) and SPL (Splunk) detection queries mapped to MITRE ATT&CK techniques, with tuning notes — covering credential access, lateral movement, persistence, defense evasion, cloud (Entra ID, AWS), email, Linux and ransomware impact. This free soc & threat intel tool runs entirely in your browser — no data leaves your device, no account required, and it keeps working offline once the page has loaded.