KQLIntel

KQLIntel is a powerful, browser-based tool designed to bridge the gap between unstructured threat intelligence reports and actionable Kusto Query Language (KQL) queries. It leverages the power of modern Large Language Models (LLMs) to analyze threat reports from URLs or raw text, intelligently extract Indicators of Compromise (IOCs), and automatically generate KQL queries ready for threat hunting in Microsoft Sentinel and other security platforms. The tool is designed for security analysts, threat hunters, and incident responders who need to quickly operationalize threat intelligence without manual parsing and query creation. - Intelligent IOC Extraction: Automatically identifies and extracts key IOCs, including IPs, domains, file hashes (MD5, SHA1, SHA256), filenames, and URLs. - Automatic KQL Generation: Instantly generates "guaranteed" KQL queries based on the extracted IOCs, ready to be used in your security tools. - AI-Powered Enhancements: - Threat Summaries: Get a concise, AI-generated summary of the threat report. - Advanced Hunting Queries: Discover deeper threats with experimental, AI-suggested hunting queries. - Mitigation Suggestions: Receive actionable mitigation steps to respond to the identified threats. - Flexible Input: Analyze intelligence by providing a URL to a public report or by pasting in raw, unstructured text. - Multi-Provider LLM Support: Integrates with a wide range of LLM providers, including Google Gemini, OpenAI, Azure OpenAI, Anthropic, and any provider compatible with the OpenRouter API. - Modern UI: Features a sleek, user-friendly interface with both dark and light modes to suit your preference. - Secure by Design: API keys are stored securely in your browser's local storage and are never exposed or transmitted anywhere except to the respective AI provider's endpoint. KQLIntel is the open-source project Var5h1l/KQLIntel (https://github.com/Var5h1l/KQLIntel) by Var5h1l, released under MIT. Ion packages it unmodified from commit f8c55307a789, adding only a manifest, an icon and a storage compatibility script.

Written by Var5h1l, published to Oikou by Ben Grande.

• ★ 31 stars on GitHub
• Licence: MIT
• Built from commit f8c55307a789

View the repository on GitHub

Not rated. Nobody has said who this app is suitable for, so Personal Clouds and the Oikou app treat it as 18+.

Internet

It asks to reach these hosts, and no others:

• api.anthropic.com
• api.openai.com
• cdn.tailwindcss.com
• fonts.googleapis.com
• fonts.gstatic.com
• generativelanguage.googleapis.com
• openrouter.ai
• r.jina.ai
• any address under openai.azure.com

Personal Cloud tools

• Keep a database of its own on your Personal Cloud ion.db

Notifications

It does not send push notifications.

Storage

Up to 16 MB on your Personal Cloud.

Sign in to add this web app to a Personal Cloud of yours. It runs there, on your own computer, and you open it from there; nothing is installed on your phone.

Sign in to add