Security query languages
Every major SIEM, EDR and XDR has its own way to search its data. Here they all are, with the products that use each one and links to the official docs.
On SOC Fluent at launch
Practise these with ticket-style exercises on realistic lab data.
- Microsoft
KQL
Kusto Query Language
A piped language for hunting and log search across Microsoft security data.
Used in Microsoft Defender XDR advanced hunting, Microsoft Sentinel, Azure Monitor.
- Elastic
Kibana KQL
Kibana Query Language
Filters events in the search bar. Not related to Microsoft’s KQL.
Used in Kibana Discover, Elastic Security search bar.
- Elastic
ES|QL
Elasticsearch Query Language
A piped language that filters, counts and reshapes Elastic data.
Used in Kibana Discover, Elastic Security, detection rules.
- Sophos, built on osquery
osquery SQL
SQL that asks devices about their processes, users, ports and files as if they were tables.
Used in Sophos Central Live Discover and Data Lake.
Coming soon to SOC Fluent
Tracks we’re building after launch.
- Splunk
SPL
Search Processing Language
A piped language for searching, counting and charting Splunk data.
Used in Splunk Enterprise, Splunk Cloud Platform, Splunk Enterprise Security.
- CrowdStrike
CQL
CrowdStrike Query Language
A piped language for searching and aggregating Falcon events. It grew out of the LogScale query language.
Used in Falcon Next-Gen SIEM, Falcon LogScale, Falcon event search.
- CrowdStrike
FQL
Falcon Query Language
A filter syntax for picking and sorting records, like hosts or detections, in Falcon lists and API calls.
Used in Falcon console filters and the Falcon APIs.
- Trend Micro
Vision One search
Field and value query strings for finding activity data in Trend Vision One.
Used in Trend Vision One Search app.
- Rapid7
LEQL
Log Entry Query Language
Searches InsightIDR logs. Queries are built around a where() clause that filters log entries.
Used in Rapid7 InsightIDR log search.
More security query languages
Not on SOC Fluent yet. If you use one, pick “Something else” when you join the waitlist.
- Elastic
EQL
Event Query Language
Finds sequences of events, like a process starting and then making a network connection.
Used in Elastic Security detection rules and Timeline.
- Elastic
Lucene
Lucene query syntax
The older search bar syntax, still available as an option in Kibana.
Used in Kibana search bar, as an alternative to Kibana KQL.
- Palo Alto Networks
XQL
Cortex Query Language
A piped language for threat hunting and investigation across Cortex data.
Used in Cortex XDR, Cortex XSIAM.
- IBM
AQL
Ariel Query Language
A SQL-like language for querying QRadar event and flow data.
Used in IBM QRadar.
- Google
UDM search and YARA-L 2.0
UDM search finds events in Google’s Unified Data Model. YARA-L 2.0 writes the detection rules.
Used in Google Security Operations, formerly Chronicle.
- SentinelOne
PowerQuery
A piped language for filtering, grouping and statistics on SentinelOne data.
Used in SentinelOne Singularity Data Lake.
- Sumo Logic
Sumo Logic search
Sumo Logic search query language
A piped language with parsers and operators for searching and counting logs.
Used in Sumo Logic log search.
- Open standard, SigmaHQ
Sigma
Sigma rules
A shared format for detection rules. You write a rule once and convert it into the languages above.
Used in most SIEMs, through converters.
Learn the one your next job uses
SOC Fluent launches with KQL, Elastic and Sophos SQL, with more to follow. Join the waitlist and we’ll email you once, on launch day.
Free to join. Students get 50% off at launch.