Sign inSign up

jonesckevin/querycast

By jonesckevin

•Updated about 2 months ago

Offline - SIEM Query Converter Web UI

Image
0

277

jonesckevin/querycast repository overview

⁠QueryCast — Universal SIEM Query Translator

Fast offline web tool to convert Sigma rules and SIEM queries across multiple SIEM platforms and EDR tools.

Example

⁠Features

FeatureDescription
Sigma Rule ConversionConvert Sigma rules to various SIEM query languages (Splunk SPL, Elastic EQL)
Query TranslationTranslate queries between different SIEM platforms
Batch IOC ConversionConvert lists of IOCs (IPs, domains, hashes) into SIEM-specific query formats
Offline FunctionalityFully client-side, no server required
DockerizedEasy deployment with Docker
ExtensibleModular architecture for adding new conversion operators
User-Friendly UIClean interface for quick conversions
Syntax HighlightingOutput is highlighted for better readability
Export OptionsSave converted queries in various formats (TXT, JSON, etc.)
Ai Assisted SuggestionsOnline or Custom Offline LLM support for query optimization.

⁠Quick Start

  1. Clone or download the project:

    git clone github.com/jonesckevin/QueryCast
cd QueryCast

  2. Open index.html in your browser:

    # Linux
xdg-open index.html

# Windows
start index.html

    Or use a local server:

    npx http-server -p 80 -o

  3. Start converting!

    • Paste a Sigma rule, query, or IOC
    • Choose a conversion operator (e.g., "Splunk SPL")
    • Get instant output
⁠Docker Compose
docker-compose up --build
⁠Docker Run
docker build -t querycast:latest .
docker run -d -p 4007:80 --name querycast querycast:latest
⁠Docker Hub Pull
docker pull jonesckevin/querycast:latest
docker run -d -p 4007:80 --name querycast jonesckevin/querycast:latest

Then open http://localhost:4007⁠.

Tag summary

Content type

Image

Digest

sha256:bcf70e9fd…

Size

25.4 MB

Last updated

about 2 months ago

docker pull jonesckevin/querycast