Skip to content
SOC FluentSpeak SIEM and EDR
Join the waitlist
IN DEVELOPMENT · JOIN THE WAITLIST FOR LAUNCH

Learn and practise KQL, ES|QL
and the SIEM and EDR query languages your job asks for.

SOC Fluent is a platform for learning KQL, ES|QL and other SIEM and EDR query languages in your browser, with theory and hands-on labs. No licence or home lab needed.

1 · THE LESSON
Lesson 4 · Counting

summarize count() by DeviceName counts rows and gives you one row per device.

Sort on the count to put the busiest first.

2 · THE QUESTION

Which devices started the most processes in the last 24 hours? Put the busiest first.

1DeviceProcessEvents
2| where Timestamp > ago(24h)
3| summarize processes = count() by DeviceName
4| sort by processes desc
3 · WHAT YOU GET BACK
DeviceNameprocesses
srv-build023,412
fin-lt-01421,208
hr-lt-0031906
Which device started the most processes?
srv-build02 Correct

Free to join. One email at launch, nothing else.

Learn and practise SIEM and EDR query languages without access to either.

Most of the work in a SOC comes down to asking the security logs the right question and making sense of what comes back. That’s hard to practise unless you already have the job. SOC Fluent gives you the logs, the questions and the feedback, all in your browser.

Whether you’re studying cybersecurity, job hunting, picking up a new MSSP client or moving your SOC to a new SIEM or EDR, every lesson and exercise works in each language we support. Pick the language you need and become fluent in it.

DEFENDER & SENTINEL KQL
DeviceProcessEvents
| where FileName =~ "cmd.exe"
| project DeviceName, AccountName
ELASTIC KQL
event.category : "process"
and process.name : "cmd.exe"
SOPHOS SQL
SELECT pid, name, cmdline
FROM processes
WHERE LOWER(name) = 'cmd.exe'

Nothing to set up. No SIEM or EDR licence, no home lab, no installs. Pick the query language you need and start on the first lesson.

Learn the basics, then practise on exercises that get harder as you go.

  1. Pick your language

    Choose the SIEM or EDR query language you need. KQL, Elastic and Sophos SQL are ready at launch.

  2. Learn the basics

    Short lessons teach one idea at a time, with an example you can run in the query editor.

  3. Answer the questions

    Each lesson ends with questions. Write a query to find the answer and see right away if it’s right.

  4. Then practise on tickets

    Exercises written like real shift tickets. A miss shows which rows you didn’t return.

Which language your tool uses

Every one of these is a track at launch, except where marked.

ToolTypeQuery languageWorth knowing
Microsoft Defender XDREDR / XDRKQL (Kusto Query Language)Called “advanced hunting” in the portal.
Microsoft SentinelSIEMKQL (Kusto Query Language)Same language as Defender, different tables.
Elastic Security / KibanaSIEMKibana KQL and ES|QLKibana’s KQL shares the name with Microsoft’s, but it’s a different language.
Sophos CentralEDR / XDRSQL (osquery)Plain SELECT … FROM … WHERE. Live Discover queries connected endpoints; Data Lake queries look back up to 30 days.
Splunk Enterprise / Cloudcoming soonSIEMSPL (Search Processing Language)Field names are case-sensitive, values aren’t.
CrowdStrike Falconcoming soonEDR / SIEMCQL (CrowdStrike Query Language) and FQL (Falcon Query Language)CQL searches events in advanced event search and Next-Gen SIEM. FQL filters hosts, detections and policies in the console and API.
Trend Vision Onecoming soonXDR / EDRVision One search syntaxKibana-like field:value queries, but matching works on whole tokens, which catches people out.
Rapid7 InsightIDRcoming soonSIEMLEQL (Log Entry Query Language)Searches one log set at a time, so pick the right logs before you write anything.

Questions people ask first

When can I use it?

When SOC Fluent launches. Join the waitlist and we’ll email you then. If you tick the box to test before launch, we may invite you earlier. We’re letting small groups in first, so places are limited.

I’ve never written a query. Can I start here?

Yes. Every track starts from the basics, with short lessons and examples you can run, before you start on exercises.

Is any of the data real?

No. The lab tenant is generated, then shaped to look like what you’d see on shift, with noisy hosts, mixed-case process names and service accounts nobody documented. It resets every night.

Do I need a Microsoft, Elastic or Sophos account?

No. Queries run here, against our data.

Is this certification prep?

Not directly. It overlaps with what SC-200 covers, but the exercises are written for the job, not the exam.

Get hands on with SIEM and EDR languages before the interview, the migration or the incident.

SOC Fluent is in development. Join the waitlist and we’ll email you once, on launch day. We’re launching with these languages.

KQL · Defender and Sentinel Elastic KQL and ES|QL Sophos SQL (osquery)

Free to join. Students get 50% off at launch.