Cheat sheet

SIEM queries

KQL for Elastic/Kibana, SPL for Splunk. The triage process is in SOC and SIEM.

CJCADefence

KQL and SPL side by side

I want…	KQL (Kibana)	SPL (Splunk)
Equality	`event.code:4625`	`EventCode=4625`
Several values	`event.code:(4624 or 4625)`	`EventCode IN (4624, 4625)`
Exclude	`not user.name:"svc_backup"`	`NOT user="svc_backup"`
Wildcard	`process.name:powershell`	`process_name="powershell"`
Field exists	`process.command_line:*`	`process_command_line=*`
Range	`destination.port >= 1024`	`dest_port>=1024`
Network	`source.ip:10.0.0.0/8`	`\| where cidrmatch("10.0.0.0/8", src_ip)`
Count by field	Visualisation (not in KQL)	`\| stats count by user`
Threshold	Threshold rule in Elastic Security	`\| stats count by src_ip \| where count > 10`
Sort, limit	Column sort in Discover	`\| sort -count \| head 10`

PitfallSPL field names depend on how the data was indexed. Check them in the fields sidebar before writing the query.

Common ECS fields (Elastic)

Field	Content
@timestamp	Event date
event.code	Event identifier (e.g. Windows Event ID)
event.action / event.outcome	Action performed / success or failure
host.name	Machine that produced the event
user.name	Account involved
process.name / process.command_line	Process and its command line
process.parent.name	Parent process
source.ip / destination.ip	Source and destination addresses
destination.port	Destination port
file.path / file.hash.sha256	File involved and its hash
winlog.event_data.LogonType	Windows logon type

Ready-to-use queries (KQL)

# Failed logons on one account
event.code:4625 and user.name:"administrator"
# Successful RDP logons
event.code:4624 and winlog.event_data.LogonType:10
# PowerShell launched by an Office document
process.name:"powershell.exe" and process.parent.name:("winword.exe" or "excel.exe")
# Encoded PowerShell
process.name:"powershell.exe" and process.command_line:*-enc*
# Access to lsass (Sysmon)
event.code:10 and winlog.event_data.TargetImage:*lsass.exe
# Audit log cleared
event.code:1102

Ready-to-use queries (SPL)

# Sources with many failed logons
index=windows EventCode=4625
| stats count by src_ip, user
| where count > 10 | sort -count
# Rare processes across the estate
index=sysmon EventCode=1
| stats count by Image | sort count | head 20