Cheat sheets
The query syntax you use most, one page per language. Every entry is checked against the vendor’s own documentation, with links to the official docs.
- KQL cheat sheetFilter, count, join and parse in Microsoft Defender advanced hunting and Microsoft Sentinel.39 entries · 6 tips · 6 official linksOpen the cheat sheet
- Elastic KQL and ES|QL cheat sheetKibana KQL for the search bar, ES|QL for counting and grouping, and the field names for both.39 entries · 6 tips · 6 official linksOpen the cheat sheet
- Sophos SQL cheat sheetLive Discover queries for processes, ports, users and files, plus Data Lake searches.22 entries · 6 tips · 6 official linksOpen the cheat sheet
- Splunk SPL cheat sheetComing with the Splunk SPL track, after launch.See what’s coming
- CrowdStrike Falcon (CQL and FQL) cheat sheetComing with the CrowdStrike Falcon (CQL and FQL) track, after launch.See what’s coming
- Trend Vision One cheat sheetComing with the Trend Vision One track, after launch.See what’s coming
- Rapid7 InsightIDR (LEQL) cheat sheetComing with the Rapid7 InsightIDR (LEQL) track, after launch.See what’s coming
Practise these in real exercises
A cheat sheet tells you the syntax. SOC Fluent gives you exercises to solve with it, on realistic lab data, and shows you what your query missed. Join the waitlist and we’ll email you once, on launch day.
Free to join. Students get 50% off at launch.