Investigate without learning SPL or KQL first
Search languages are powerful and slow to learn. The analyst who knows them is rarely the one on call at 2 a.m., and the client who needs the answer will never learn them. Dashboards that need building before they show anything make it worse.
How KIROSEC answers it
Findings first
Detection runs as soon as logs are imported. Key Findings, Alerts and Charts are populated before you type anything.
Point-and-click queries
Free-text search across the case, filter chips, and a query builder with field, operator and value — AND/OR, equals, contains, between — instead of a language to memorise.
Plain-language explanations
Any finding can be explained as who, what, when, where and why, in technical or executive wording. The explanation narrates the rule's finding; it never changes it.
Paste and triage
Paste a suspicious command line or a few log lines into Triage and get a scored, explained analysis without creating a case.
Where it stops
- Typing a question in plain English and getting a query back needs the optional on-device AI model, which is downloaded or side-loaded separately.
- Power users who know a query language will find the query builder more verbose than writing SPL or KQL by hand.
Detections that apply
Browse the full detection libraryQuestions
- Is there a query language at all?
- There is free-text search and a structured query builder. You do not need to learn a language to use either.
Related problems
See it on your own logs
Bring an incident your current tools struggle with. We will show you how KIROSEC handles it, on your machine, with nothing leaving it.