Nexus SecOps -- Detection Query Translator

Translation

From

→

Source query

KQL: LSASS access KQL: PowerShell suspicious SPL: brute force Sigma: failed logon

Translated output

Heuristic translation. Field names, operators, and syntax are mapped using a built-in cheat sheet (see below). Edge cases — joins, lookups, complex aggregations, vendor-specific functions — require manual review. Output is a starting point, not a finished detection rule.

Field Mapping Cheat Sheet (built-in)

The translator uses the following canonical → dialect mapping. If your source uses non-standard table/field names, edit before translating.

Concept	KQL (Sentinel)	SPL (Splunk)	ES\|QL (Elastic)	Sigma
Process exec table	DeviceProcessEvents	sourcetype=sysmon EventCode=1	event.code:1	logsource.category: process_creation
Process name	FileName	Image	process.name	Image
Command line	ProcessCommandLine	CommandLine	process.command_line	CommandLine
Parent image	InitiatingProcessFileName	ParentImage	process.parent.name	ParentImage
User	AccountName	User	user.name	User
Hostname	DeviceName	host	host.name	ComputerName
Time field	TimeGenerated	_time	@timestamp	(implicit)
Time bound (1h)	where TimeGenerated >= ago(1h)	earliest=-1h	where @timestamp >= NOW() - 1 HOUR	(SIEM-side)
String contains	contains	"str"	like	contains
String equals	=~ (case-insensitive)	=	==	(default)
Field in list	in~ (...)	IN (...)	in (...)	list under field
Aggregate count	summarize count() by ...	stats count by ...	stats count = count(*) by ...	(SIEM-side)
Project / table	project ...	table ... or fields ...	keep ...	(SIEM-side)
Failed logon table	SecurityEvent EventID == 4625	sourcetype=wineventlog EventCode=4625	event.code:4625	EventID: 4625 (logsource.service: security)
Network conn table	DeviceNetworkEvents	sourcetype=sysmon EventCode=3	event.code:3	logsource.category: network_connection
Remote IP/port	RemoteUrl / RemotePort	dest_ip / dest_port	destination.ip / destination.port	DestinationIp / DestinationPort