Sentinel KQL Forge: Natural Language to Hunting

2026.03.15 SUBJECT: DETECTION_ENGINEERING KQL_Synthesis Sentinel_Forge

In high-stakes Detection Engineering and Incident Response, cognitive load is a silent killer. When an analyst is deep in a 2:00 AM triage, fighting to parse JSON payloads and remember complex `mv-expand` or `make_set` syntax, speed is lost. Sentinel KQL Forge is a tactical synthesizer designed to bridge the gap between a defender's natural language hypothesis and production-ready Kusto Query Language (KQL), dramatically reducing Mean Time to Remediate (MTTR).

The Bottleneck: Syntax vs. Intent

The core problem in modern SIEM platforms isn't a lack of data; it's the friction of querying it. Translating a clear analytical intent (e.g., "Show me users who successfully authenticated from a new country and then created an inbox rule") into a multi-join KQL statement often creates critical delays. The Forge removes this syntax barrier, allowing analysts to operate at the speed of thought.

[ SCR_01: SYNTHESIZER_INTERFACE_OVERVIEW ]

Synthesizing Security Logic

Unlike generic code-generation tools, Sentinel KQL Forge is deeply schema-aware. It understands the specific nuances of the `CommonSecurityLog`, `SigninLogs`, and `DeviceNetworkEvents` tables. It knows when to use `ipv4_is_private()`, how to extract nested properties from Azure AD Audit logs, and automatically applies performance optimizations like filtering by `TimeGenerated` before heavy joins.

FORGE_SYNTHESIS.SH
# Example Natural Language Input: # "Find all Entra ID sign-ins where the location is 'Germany' but the ISP is a known commercial VPN provider. Also, check if they accessed Microsoft Graph within 10 minutes." # Generated Synthesized KQL: let VpnProviders = dynamic(['Mullvad', 'NordVPN', 'ProtonVPN', 'ExpressVPN']); SigninLogs | where TimeGenerated > ago(24h) | where Location == 'DE' | where NetworkServiceProvider has_any (VpnProviders) | project TimeGenerated, UserPrincipalName, IPAddress, OriginalSessionId | join kind=inner ( SigninLogs | where TimeGenerated > ago(24h) | where AppDisplayName has "Graph" ) on UserPrincipalName | where TimeGenerated1 between (TimeGenerated .. (TimeGenerated + 10m)) | project InitialLoginTime=TimeGenerated, GraphAccessTime=TimeGenerated1, UserPrincipalName, IPAddress

Real-World Impact

By abstracting the query mechanics, Blue Teams can shift their focus back to where it belongs: adversary behavior and threat hunting. During recent simulated engagements, the Forge enabled tier-1 analysts to pivot across identity, endpoint, and network logs in under 3 minutes, successfully identifying stealthy lateral movement paths that would typically require senior engineering time.

[ SCR_04: TIMELINE_ANALYSIS_REDUCTION ]