Detection engineering / semantic translation
Queries move.
Meaning stays.
Translate detection queries between KQL, Splunk SPL, Cortex XQL, CrowdStrike CQL and LogScale. Deterministic, schema-aware, and honest: anything that cannot be translated exactly is reported, never guessed.
- No sign-in. Queries never leave your browser.
- Every output is re-parsed and checked against the source.
- Built by a working detection engineer.
Translation workspace
Translation appears here.
Your recent translations (stored in this browser only)
The translation gap
Syntax is the visible part of the problem.
A detection can look translated and still be wrong. A field may map to a different entity. A wildcard can become a literal. KQL contains ignores case while a LogScale match does not. A missing filter quietly changes what the rule catches.
Rulattice treats each conversion as a semantic migration: language, schema, unsupported concepts and validation in one traceable result.
The method
From dialect to deployable logic.
- 01
Parse the intent
Each query is parsed into one canonical model: source, time window, filters, projections, aggregations, sort and limit. Case sensitivity and wildcard semantics are recorded, not assumed.
- 02
Map the model
Time fields and aggregate names are bridged automatically. Entity fields (user, host, IPs, process) can optionally be mapped to ASIM, CIM, XDM, Falcon or ECS names, and each mapping is listed for review.
- 03
Explain the gap
Anything outside the exact subset is rejected with a reason. The output is then parsed again in the target language and compared to the source model, so you know it says what the original said.
Coverage map
One detection practice. Many dialects.
| Platform | Language | Model awareness | Aggregation |
|---|---|---|---|
| Microsoft Sentinel / Defender | KQL | ASIM | summarize |
| Splunk | SPL | CIM | stats |
| Palo Alto Cortex XDR / XSIAM | XQL | XDM | comp |
| CrowdStrike Falcon NG-SIEM | CQL | Falcon events | groupBy |
| Falcon LogScale | LogScale | ECS-style | groupBy |
Supported: source selection, relative time windows, AND / OR / NOT filters, equality and numeric comparisons, contains / starts with / ends with, list membership, regex, field include / exclude, count / distinct count / sum / min / max / avg by fields, sort and limit. Full reference and known gaps.
Detection packs
Tested detections, already translated.
The translator handles syntax. Packs handle the hard part: rules written for real telemetry, field-mapped per platform, with tuning notes from production.
Next signal
New packs and translation notes, monthly.
One email a month. Detection content, platform quirks worth knowing, and first access to new packs. Unsubscribe any time.
Who built this