Rulattice

Translates detection queries between Sentinel, Splunk, Cortex, CrowdStrike and LogScale. When something has no exact equivalent, it says so instead of guessing.

Open the translator Read the reference

Free to use. Translation runs entirely in your browser, so your queries never leave the page.

One Cortex rule, four platforms

A real detection: MMC opening a .msc file from a user-writable folder. It was translated with field mapping on. The notes under each output are the engine's own review items, unedited.

Cortex XQL, the source

preset = xdr_process
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START and agent_os_type = ENUM.AGENT_OS_WINDOWS
| filter action_process_image_path in ("*\mmc.exe") and action_process_image_command_line contains ".msc"
| filter action_process_image_command_line contains "\Users\" or action_process_image_command_line contains "\Temp\" or action_process_image_command_line contains "\ProgramData\"
| filter not (action_process_image_command_line contains "eventvwr.msc /s" or action_process_image_command_line contains "CompMgmt.msc")

Sentinel KQLDefender XDR tables Splunk SPLSysmon CrowdStrike CQLFalcon events LogScaleECS fields

DeviceProcessEvents
| where FolderPath endswith "\\mmc.exe" and ProcessCommandLine contains ".msc"
| where ProcessCommandLine contains "\\Users\\" or ProcessCommandLine contains "\\Temp\\" or ProcessCommandLine contains "\\ProgramData\\"
| where not(ProcessCommandLine contains "eventvwr.msc /s" or ProcessCommandLine contains "CompMgmt.msc")

CautionThe Windows OS condition was dropped: Defender XDR event tables carry no OS column. Results are wider than the source. Join DeviceInfo on DeviceId to restrict by OS.
ReviewCortex ENUM event class (Windows process start events) was rewritten as source DeviceProcessEvents. Event coverage differs between sensors; check that the target collects the same events.
ReviewMapped action_process_image_path → FolderPath (process image path). Path formats differ (device paths, drive letters, case). Check how your sensor records them.
2 more in the translator

index=*
| search sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| search Image="*\\mmc.exe" CommandLine="*.msc*"
| search CommandLine="*\\Users\\*" OR CommandLine="*\\Temp\\*" OR CommandLine="*\\ProgramData\\*"
| search NOT (CommandLine="*eventvwr.msc /s*" OR CommandLine="*CompMgmt.msc*")

ReviewSysmon events were selected by sourcetype XmlWinEventLog:Microsoft-Windows-Sysmon/Operational (Splunk Add-on default). Replace index=* with your Sysmon index.
ReviewCortex ENUM event class (Windows process start events) was rewritten as index=* and a selector filter. Event coverage differs between sensors; check that the target collects the same events.
ReviewMapped action_process_image_path → Image (process image path). Path formats differ (device paths, drive letters, case). Check how your sensor records them.
2 more in the translator

#event_simpleName=ProcessRollup2
| event_platform = /^Win$/i
| ImageFileName = /\\mmc\.exe$/i and CommandLine = /\.msc/i
| CommandLine = /\\Users\\/i or CommandLine = /\\Temp\\/i or CommandLine = /\\ProgramData\\/i
| not (CommandLine = /eventvwr\.msc \/s/i or CommandLine = /CompMgmt\.msc/i)

ReviewFalcon also emits SyntheticProcessRollup2 for processes that started before the sensor. Add it if you need those.
ReviewCortex ENUM event class (Windows process start events) was rewritten as source ProcessRollup2 and a selector filter. Event coverage differs between sensors; check that the target collects the same events.
ReviewMapped action_process_image_path → ImageFileName (process image path). Path formats differ (device paths, drive letters, case). Check how your sensor records them.
2 more in the translator

#repo=xdr_process
| event.category = /^process$/i and event.type = /^start$/i and host.os.type = /^windows$/i
| process.executable = /\\mmc\.exe$/i and process.command_line = /\.msc/i
| process.command_line = /\\Users\\/i or process.command_line = /\\Temp\\/i or process.command_line = /\\ProgramData\\/i
| not (process.command_line = /eventvwr\.msc \/s/i or process.command_line = /CompMgmt\.msc/i)

Review"preset = xdr_process" was carried as a plain source name.
ReviewSelected with ECS fields (event.category, event.type, host.os.type). Confirm your parsers populate them.
ReviewCortex ENUM event class (Windows process start events) was rewritten as a selector filter. Event coverage differs between sensors; check that the target collects the same events.
4 more in the translator

What it translates

Languages: Sentinel and Defender KQL, Splunk SPL, Cortex XQL, CrowdStrike CQL and Falcon LogScale, in any direction.
Filters: And, or, not, equality and numeric comparisons, contains, starts with, ends with, lists, regex and wildcards. Each platform's case sensitivity is preserved, not assumed.
Aggregation: Count, distinct count, sum, min, max and average by fields, with thresholds, sort and limit after the aggregation still pointing at the right column.
Computed fields: extend, eval, alter and :=, renames, and scalar let constants, using one shared function set. SPL's 1-based substr becomes KQL's 0-based substring without you thinking about it.
Event classes: Cortex ENUM constants become the target's native selector: Defender XDR tables, SecurityEvent 4688 or ASIM for Sentinel; Sysmon or Security log event codes for Splunk; Falcon event names; ECS fields for LogScale.
Field mapping: Optional. Picks names for the data source you choose, and reports every rename so you can check it.

What it refuses

If a construct has no exact equivalent on the target, Rulattice returns no output and names the construct. Joins, lookups, time bucketing and functions outside the shared set are refused today.

That is deliberate. A refusal costs you a minute. A confident, wrong translation costs you a detection that never fires.

How it checks itself

Every output is parsed again in the target language and compared with the source. When the meaning survives the trip, the check passes. Anything it had to adapt is listed by severity:

Caution: The output can return more events than the source, such as an OS filter the target has no column for.
Review: Correct as written, but depends on your data: a mapped field name, a data source, an index to narrow.