Convert Splunk SPL to Elastic ES|QL

Free, in-browser Splunk SPL → Elastic ES|QL detection-rule converter. Paste your Splunk SPL rule below; the Elastic ES|QL equivalent (and every other dialect) is generated instantly. Deterministic, open source, no upload.

Source format

Sigma YAML

title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\\powershell.exe'
    CommandLine|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection

Microsoft Sentinel KQL

SecurityEvent
| where title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    NewProcessName|endswith: '\\powershell.exe'
    CommandLine|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection

Elastic ES|QL

FROM logs-*
| WHERE title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    process.executable|endswith: '\\powershell.exe'
    process.command_line|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection

Google Chronicle YARA-L2

rule translated_rule {
  meta:
    author = "AiSOC"
  condition:
    title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    principal.process.file.full_path|endswith: '\\powershell.exe'
    principal.process.command_line|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection
}

Google Chronicle UDM Search

// Chronicle UDM Search
title: Suspicious PowerShell download cradle
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    principal.process.file.full_path|endswith: '\\powershell.exe'
    principal.process.command_line|contains:
      - 'DownloadString'
      - 'IEX'
  condition: selection

⚠ Deterministic field-map translation, computed in your browser (no server, no LLM). Review field names before deploying.