← detection engineer

SIEM Query Languages — SPL, KQL, EQL, ES|QL

beginner 4h

Write equivalent searches across SPL, KQL, and EQL given the same hunt; master aggregation, time-bucketing, and joins.

After this module you will

  • › Apply the pipe-filter-transform mental model across query languages
  • › Write SPL queries using search, stats, eval, rex, and lookup
  • › Write KQL queries using where, summarize, project, and join
  • › Write EQL and ES|QL queries using sequence and until operators
  • › Translate the same hunt from one language to another

Lessons

1 The Mental Model — Pipes, Filters, Transforms
25 min
2 SPL Essentials — search, stats, eval, rex, lookup
30 min
3 KQL Essentials — where, summarize, project, join
30 min
4 EQL & ES|QL — Sequences, Event Correlation, Pipe Queries
25 min
5 Worked Example: Failed Logons + Success in SPL, KQL, and EQL
30 min

Module Quiz

Test your knowledge before moving on.

Take Quiz →