SOC Tools · Detection Engineering

KQL Query Builder

Assemble valid KQL for Microsoft Sentinel (Log Analytics) or Defender XDR Advanced Hunting — stage by stage, with the right schema, the right time column, joins, time-series buckets, and type-aware operators. Builds queries; never runs them.

Loading schemas… · Client-side only — nothing leaves the browser

Environment
1 Table TableName

2 Time range | where … > ago()
3 Filters | where

Consecutive OR rows are grouped in parentheses; AND starts a new where clause.

4 Join (off)
5 Columns | extend · | project
Project columns (empty = all columns)
6 Aggregate | summarize … by
7 Sort & limit | top · | order by · | take
Generated KQL
Saved queries (this browser only)

Frequently asked questions

What is KQL?

KQL (Kusto Query Language) is the query language used by Microsoft Sentinel (Log Analytics) and Microsoft Defender XDR Advanced Hunting to search and analyze security telemetry.

Does the builder work for both Sentinel and Defender?

Yes. You pick the environment and the builder uses the correct schema and time column — TimeGenerated for Sentinel / Log Analytics, Timestamp for Defender XDR Advanced Hunting — plus the right table names for each.

Can it build joins and time-series queries?

Yes. A dedicated join stage correlates two tables (inner, leftouter, semi, anti, and more) with match keys and an optional time filter on the right table, and the aggregate stage supports bin() time buckets with render timechart for time-series hunts.

Does this tool run my queries?

No. It only assembles valid KQL text for you to copy into Sentinel or Defender. It never connects to your tenant or executes anything, and it runs entirely in your browser.

Can I share a query or turn it into a detection rule?

Yes. Copy a shareable deep-link that rebuilds the exact query in someone else's browser, or export the query as a Microsoft Sentinel scheduled analytics rule (YAML) or a Defender XDR custom detection.

Are there starter templates?

Yes — 38 MITRE ATT&CK-tagged templates spanning twelve tactics cover common hunts so you can start from a working query and adapt it to your environment.

WinEvents → Windows Event ID lookup with MITRE ATT&CK mappings RegEx Lab → Regex tester with ReDoS detector & security patterns TokenDecoder → JWT / SAML / OIDC token inspector