Threat Hunting Query Languages (KQL, SPL, CQL)

Threat hunting query languages are the languages security tools use to search their data. Each major SIEM, EDR and XDR platform has its own: Splunk uses SPL, Microsoft Sentinel and Defender use KQL, CrowdStrike uses CQL, and so on. A hunter who wants to find a technique across several tools has to express the same idea in each language, with each tool's own field names.

The Main Languages

Note the name clash: KQL means Kusto Query Language in Microsoft products and Kibana Query Language in Elastic. They are unrelated languages.

The Same Hunt in Each Language

The examples below look for process starts of rundll32.exe and count them by host and command line. They are illustrative; field names and data sources vary by deployment.

Splunk SPL (Sysmon process creation):

index=windows source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\rundll32.exe"
| stats count by host, CommandLine

Kusto KQL (Microsoft Defender advanced hunting):

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "rundll32.exe"
| summarize count() by DeviceName, ProcessCommandLine

CrowdStrike CQL (Falcon process events):

#event_simpleName=ProcessRollup2 ImageFileName=/\\rundll32\.exe$/i
| groupBy([ComputerName, CommandLine])

Cortex XQL:

dataset = xdr_data
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter action_process_image_name = "rundll32.exe"
| comp count() by agent_hostname, action_process_image_command_line

SentinelOne PowerQuery:

event.type = 'Process Creation' tgt.process.name = 'rundll32.exe'
| group count = count() by endpoint.name, tgt.process.cmdline

Google SecOps UDM search:

metadata.event_type = "PROCESS_LAUNCH" AND target.process.file.full_path = /rundll32\.exe$/ nocase

Elastic ES|QL:

FROM logs-endpoint.events.process-*
| WHERE event.type == "start" AND process.name == "rundll32.exe"
| STATS count = COUNT(*) BY host.name, process.command_line

What Differs Beyond Syntax

• Field names: the process name is Image in Sysmon, FileName in Defender, ImageFileName in CrowdStrike, action_process_image_name in Cortex.
• Case handling: some operators are case-sensitive by default and some are not, which can silently drop matches.
• Time and limits: each tool caps result counts, query time or cost differently, and keeps data for different lengths of time.
• Data shape: some tools store one row per event, others group related events, so counts are not always comparable.

Sigma as a Common Format

Sigma rules describe detections in a vendor-neutral YAML format that can be converted into many of these languages. Conversion handles the basic syntax, but field mappings and tool-specific behavior still need checking, so converted queries should be tested against real data before anyone trusts a zero-result answer.

FourCore HUNT writes and runs hunts in each tool's native language, so teams can search Splunk, Sentinel, Defender, CrowdStrike, SentinelOne, Cortex XDR, Google SecOps and Elastic without moving data.

Frequently Asked Questions

What query language is used for threat hunting?

It depends on the tool. Splunk uses SPL, Microsoft Sentinel and Defender use Kusto Query Language (KQL), CrowdStrike uses CQL, Cortex XDR uses XQL, SentinelOne uses PowerQuery, Google SecOps uses UDM search, and Elastic supports Kibana KQL, EQL and ES|QL.

Is KQL the same in Microsoft Sentinel and Elastic?

No. In Microsoft products KQL stands for Kusto Query Language, a pipe-based analytics language. In Elastic, KQL is Kibana Query Language, a simpler filter syntax.

Which threat hunting query language should I learn first?

Learn the one your main SIEM or EDR uses, since that is where most of your hunts will run. The concepts of filtering, grouping and joining carry over, so a second language comes faster.

Related Terms

• Threat Hunting
• Sigma Rules
• SIEM
• Federated Search (Security)
• Detection Engineering