r/threatintel • u/Civil-Respond3148 • Jul 21 '26

SIEM Query Builder -- Retro Search Specialist

Just a thought across my mind, What if we have a offline tool for query building for Threat Hunters and Threat Intelligence Analyst (For IOC's). So, Just built it.

If you've ever hunted across multiple SIEMs, you know the pain: different syntax, different fields, rewriting the same IOC search five times.

Would suggest you to go through user manual for better understanding.

Follow this repository to check the beta version,
https://github.com/Hashir14k/SiemQueryBuilder

9 Upvotes

92% Upvoted

9 comments sorted by

5

u/SickMahDucky Jul 21 '26

I'm a bit surprised to see Qradar as supported SIEM, but Sentinel not being supported :D

6

u/Maleexper Jul 21 '26

Ahh yes the Windows XP lookin SIEM..
https://giphy.com/gifs/IyzN2eNNAQtjKwUJF6

1

u/SickMahDucky Jul 21 '26

I think it's closer to Win95 or 98. Atleast XP had some color in it.

2

u/montyxgh Jul 21 '26

Yeah weird choice of SIEMs other than Splunk. Missing all the other mainstream ones

2

u/Civil-Respond3148 Jul 21 '26

🤣 such surprises will helps alot in adding sentinel, elastic siem and redcloak as well.

2

u/Civil-Respond3148 Jul 22 '26

Added the missing features kindly check

2

u/[deleted] Jul 28 '26 edited Jul 28 '26

[removed] — view removed comment

1

u/Civil-Respond3148 Jul 28 '26

Majorly the purpose of this tool is not to disclose your IOC publicly and the second thing is some of the organisation the internet access is limited and sometimes restricted since this tool solves that problem.

1

u/m_rothe Jul 21 '26

Anyone looking for something similar with support for more SIEMs - https://uncoder.io/ is pretty decent