Natural language to KQL and PowerShell helper
Describe what you want to find. Pick a reviewed read-only template for Entra, Defender, Sentinel, Azure, Exchange Online or Microsoft Graph, fill in the fields and copy the query. An optional AI draft is available for requests the templates do not cover.
AI draft (optional)
Templates run in your browser. If you press the button below, only your description (with email addresses, IP addresses and tokens masked) is sent to an AI service to draft a query. The draft is checked on our server and discarded unless it is read-only, but it can still be wrong or inefficient. We do not store it.
Exactly what will be sent
Templates are fixed, hand-written and read-only (they use only Get, Search, Select, Where, Sort and similar commands, or KQL that only reads tables). They assume the logs and licences named in each query header and cannot know your schema, retention or permissions. Nothing is executed here. For help with your environment, request a service session.