Ready-to-Run Queries for XQL, KQL & SPL

A curated library of detection and hunting queries for the analyst's first five minutes on a case — searchable by category, platform, or MITRE ATT&CK tactic, with a verified query in every platform it supports.

—Queries

—Categories

—Platforms

How to use

Browse or search: filter the Workspace by category or platform, or search by title, category, tactic, or tag.
Pick a query: click any result for the full detail — description, MITRE tactic/technique, and tags.
Switch platform: each query ships in every platform it supports; switch tabs in the query panel to see XQL, KQL, or SPL, with verified variants marked.
Copy and run: hit COPY to grab the query text, and replace any <placeholder> values before running it.

Shortcuts

/Focus search

↑↓Move through results

EscClose detail view

Capabilities

Category & platform filtersFilter by any of the 10 categories — Auth, Network, Endpoint, Cloud, SIEM, Identity, App Identities, OAuth, Email, Collaboration — and by XQL, KQL, or SPL, in any combination.

MITRE ATT&CK mappedEvery query carries its ATT&CK tactic and technique, browsable from the coverage matrix — click any tactic to filter the workspace to it.

Recently addedA rolling 14-day filter surfaces what's new without hunting through the full list.

Verified variantsWhere a query has been run and confirmed against real data, its platform tab is marked verified.

Keyboard-first/ to search, arrow keys to move through results, Esc to back out — built for fast triage.

One-click copyGrab the exact query text for the active platform tab, with any <placeholder> values clearly marked before you run it.

ATT&CK tactic coverage

MITRE ATT&CK Enterprise tactics mapped from QUICKTRACE query metadata. Click a tactic to filter the workspace to it.

No coverage

1 query

2+ queries