| KQL Workbench
Catalog Builder IOC hunt runs in your browser

Microsoft Sentinel queries, without memorizing KQL

Start from a proven hunting query, build your own from simple forms, or turn a list of indicators into ready-to-run sweeps. Copy the result into Sentinel or Defender and run it there.

Catalog

Ready-made hunting queries: password spray, sign-ins from abroad, inbox-rule changes, phish that reached inboxes and more. Fill in a user or a time range and copy.

Browse the catalog →

Builder

Pick a table, a time range and filters, and the KQL writes itself as you go. Suggestions for columns and common values, plus one-click quick starts like failed sign-ins or legacy auth.

Open the builder →

IOC hunt

Paste IPs, domains, URLs, hashes or a whole threat report (defanged is fine) and get one sweep query per indicator type across every table it could appear in.

Start a hunt →

Query builder

1 · Table

Pick a common table or type any table name (custom _CL tables work).
Quick start:
Last
Applies to TimeGenerated.

2 · Filters

User, email and device columns default to equals (any case), since logs keep whatever capitalization the source used. List operators take comma- or line-separated values. Write {{name}} as a value to mark a value you'll replace before running.

3 · Output

Columns to show
All columns
Calculate
Group by
Time buckets of
(adds bin(TimeGenerated, …))

4 · Sort, limit, chart

Your draft is kept in this browser tab only, so it survives a reload and is gone when you close the tab. A share link holds the query settings after the #, the part of a URL browsers never send to a server, but anyone you give the link to can read every value you typed (user names, IPs). Leave out student or staff details, or use a {{placeholder}}, before sharing.

IOC hunt

IPs, domains, URLs, file hashes (MD5, SHA1, SHA256), email addresses and file names. Paste a list, a threat report or an alert email; defanged values like hxxp:// and evil[.]com are fine. Indicators are found by pattern matching, not AI, and nothing you paste is saved.
Search the last

Paste indicators on the left. You'll get one sweep query per indicator type, each searching every Sentinel and Defender table where that kind of indicator shows up.

Query catalog

No queries match.

Fill in

Fields marked * are required; the rest use the default shown. What you type stays on this page and isn't saved.

Private by design. This is a static page: everything happens in your browser and nothing you type is sent anywhere. The page's Content-Security-Policy (connect-src 'none') stops it from making any network requests at all, which you can confirm in your browser's developer tools.

Column lists cover common tables and aren't exhaustive; any table or column name works. Not affiliated with Microsoft. Always review a query before running it.