socq

jcli install socq

# Find a user's sign-ins for the last 7 days (KQL for Sentinel)
socq --target sentinel find-user --name "alice@example.com" --last-7d

# Same intent, Defender XDR dialect (Timestamp instead of TimeGenerated)
socq --target defender find-user --name "alice@example.com" --last-7d

# QRadar AQL, last 24 hours (default)
socq --target qradar find-user --name "alice"

# Failed logins above a threshold
socq --target sentinel failed-logins --user "alice" --threshold 10 --last-24h

# All connections from a host to a specific destination IP
socq --target defender host-connections --host WIN-001 --to-ip 1.2.3.4 --last-3d

# Hash IOC hunt across endpoint telemetry
socq --target defender ioc-hash --sha256 ab12cd34...

# Time window via explicit START/STOP
socq --target qradar ioc-ip --ip 10.0.0.5 --between "2026-06-01 00:00" "2026-06-04 12:00"

# Look up a Windows Security Audit event by ID (410 entries, offline)
socq event winos 4624
socq event winos 4769

# Free-text search across summary + detail + category
socq event winos --search "pre-auth"
socq event winos --search "lockout"

# Hierarchical source slot — linux / cisco / siem catalogues land later
socq event linux 1100

# Port lookup with colour-coded status (green SECURE / red INSECURE / …)
socq port 22
socq port 23
socq port 6379

# Free-text search across the curated catalogue
socq port --search wireguard
socq port --search smb

# Compact one-liner per row across the whole catalogue
socq port --list

# List every recipe with the SIEMs it supports
socq list-recipes

# Per-recipe prerequisites + analyst notes + MITRE tags + doc citations
socq explain kerberos-anomaly

# Wrap the query with a 4-line header comment (target / recipe / time / source)
socq --target sentinel --header find-user --name alice --last-24h

# Copy directly to the clipboard via wl-copy / xclip / xsel
socq --target qradar --copy ioc-ip --ip 1.2.3.4

# Markdown export — wraps the emitted query in a fenced code block
# tagged `kql` / `sql` so it pastes cleanly into runbooks
socq --target sentinel --format md find-user --name alice --last-24h
socq --target defender --format md --header host-processes --host WIN-001

# MITRE ATT&CK technique lookup — ~60 curated enterprise techniques
socq ttp T1059.001          # by T-code
socq ttp "powershell"       # by name (case-insensitive substring)
# → tactic + summary + attack.mitre.org URL + list of matching recipes

# Investigation packs — ordered multi-recipe playbooks
socq pack                   # list available packs
socq pack bec               # BEC walkthrough (find-user → risky-signins → mfa-fatigue → …)
socq pack ransomware        # ransomware playbook
socq pack credential-theft  # credential-theft hunt
socq pack insider-exfil     # insider exfiltration scenario
socq pack initial-access    # initial-access discovery
socq pack privilege-escalation

# KQL / AQL syntax quick-reference cards
socq syntax operators       # core operator tables, per dialect
socq syntax time            # time-window patterns
socq syntax aggregation     # summarize / group-by recipes