KQL jq Bridge

KQL/jq bridge literacy translates the same hunt question across syntaxes on YOUR $HUNT_LAB jsonl — one hypothesis, three query forms.

KQL jq Bridge• Audio Walkthrough

00:00/03:17

Visual · t30_kql_jq_bridge

KQL/jq bridge literacy. $HUNT_LAB only. Original Cyberlium.

Same hunt, different syntax — literacy bridges KQL, SPL, and jq on lab telemetry before vendor lock-in bites you.

L2 analysts switch SIEMs — bridging syntax preserves hunt intent. Same failed-auth hunt: KQL event.outcome:failure | summarize count() by source.ip; SPL index=auth action=failure | stats count by src_ip; jq.[] | select(.outcome=="failure") | group_by(.src_ip) on $HUNT_LAB/auth.jsonl. Cyberlium writes bridge table on YOUR $HUNT_LAB — run jq locally; SPL/KQL on paper. Next: SIEM Lab.

1. Bridge patterns (named)

Time bound: KQL @timestamp, SPL earliest=, jq select by.timestamp range. Filter: field equality vs select(). Aggregate: summarize/stats/group_by. Output: same hunt question, three columns in bridge table.

On $HUNT_LAB, complete bridge table row: hunt question, KQL, SPL, jq for one technique hypothesis.

Command guide

Try these commands — Bridge patterns (named)

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Optional command

jq manual — https://jqlang.github.io/jq/manual/

Elastic KQL — https://www.elastic.co/guide/en/security/current/kuery-query-language.html Splunk SPL — https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Search

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install jq
sudo apt install python3

macOS:

Command — copy this

brew install jq
brew install python3

Windows:

Command — copy this

choco install jq

Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
cat > "$HUNT_LAB/hunt/kql-jq-bridge.md" <<'EOF'
# KQL/SPL → jq Bridge (YOUR lab)
| SIEM query | jq equivalent |
|---|---|
| ParentProcessName=winword.exe | jq 'select(.parent=="winword.exe")' process.jsonl |
| EventCode=4625 | jq 'select(.event_id==4625)' auth.jsonl |
| dest_ip=203.0.113.99 | jq 'select(.dst_ip=="203.0.113.99")' netflow.jsonl |
EOF

Command — copy this

jq -c 'select(.event_id==4625) | {user, src_ip, ts}' "$HUNT_LAB/logs/auth.jsonl"
jq -c 'select(.parent=="winword.exe") | {process, cmdline}' "$HUNT_LAB/logs/process.jsonl"
grep winword "$HUNT_LAB/hunt/kql-jq-bridge.md"

Primary tools to practice this lesson: jq, python3. Reference sites: jq manual (https://jqlang.github.io/jq/manual/); Elastic KQL (https://www.elastic.co/guide/en/security/current/kuery-query-language.html); Splunk SPL (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Search). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why bridging beats single-vendor memorization

Organizations migrate SIEMs — hunt intent survives syntax changes. Interviews ask conceptual 'find failed logins last hour' — bridge literacy answers from lab samples.

Defenders document runbooks in org-standard syntax — students practice translation on $HUNT_LAB.

3. Ethics: lab jsonl only

Forbidden: running bridge queries on stranger production tenants. Allowed: bridge table — one hunt row with $HUNT_LAB jsonl path and chmod 600 notes.

Ship: KQL/jq bridge table for YOUR hunt hypothesis. Next: SIEM Lab.

4. What you ship: KQL/jq bridge table for $HUNT_LAB

One hunt row: question, KQL, SPL, jq. $HUNT_LAB named. NO prod queries. chmod 600.

5. What you record before the next lesson

Date. Bridge table. $HUNT_LAB named. File t30-m04-l03-kql-jq-bridge.txt chmod 600.

6. Wrong vs right: stranger prod vs YOUR hunt telemetry

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Memorize KQL only and ignore jq offline practice. Query stranger Sentinel without scope.
Right: Write KQL/jq bridge table for YOUR $HUNT_LAB hunt. Next: SIEM Lab.

Hands-on Exercise