Security operations

Get verified KQL for your next threat hunt

Corvic drafts the Kusto query from a plain-English question and explains every line. Your analyst reads it, edits it and runs it in Defender or Sentinel. Tier 1 can start a hunt without waiting on your one KQL expert.

Accounts are free. No credit card needed.

Or run a sample hunt

Built forSOC managersDetection engineersThreat huntersMSSP SOC leadsCISOs

Harbor Point Logistics SOC· queue · last 60 min

03:47 UTC

Ask

Ask Corvic about these alerts

KQL appears here for review

Alert queue0 open

The problem

Your queue grows faster than your KQL bench

SIEM is the top technical skill SOCs hire for, named by 43% of teams in the SANS 2025 SOC Survey. Most SOCs run with 2 to 10 people. Hunts and pivots end up waiting on the two or three analysts who write fluent KQL.

Hunts wait on one query writer

A Tier 1 analyst spots a strange sign-in and needs a join across SigninLogs and AuditLogs. The person who can write it is on another incident. The alert ages in the queue and MTTR climbs.

Alerts outnumber the people on shift

59% of security teams say they have too many alerts and 55% say too many false positives (Splunk State of Security 2025). Analysts close the same benign patterns every night and miss the alerts that belong together.

Reports eat the hours after containment

69% of SOCs still report metrics manually or mostly manually (SANS 2025). After an incident, someone rebuilds the timeline from query exports, case notes and Slack threads to brief the CISO by morning.

What Corvic does

Six SOC jobs Corvic takes off the queue

Each job ends in something an analyst can read, check and act on. Corvic drafts. Your analysts decide what runs.

Hunting questions to KQL

Type the question the way you would ask a senior analyst. Corvic picks the tables, writes the query and explains each clause. It also flags what to check, like a command-line flag the filter could miss.

OutputA commented KQL query to paste into Defender advanced hunting or Sentinel Logs.

Related alerts grouped into one case

Corvic groups alerts that share an account, device, IP or file hash inside a time window. The analyst opens one case with the shared indicator called out, in place of nine separate tickets.

OutputOne case note listing each alert ID and the field that links them.

Incident timelines and report drafts

Point Corvic at the query exports, case notes and chat thread for an incident. It orders events by timestamp and drafts the report in your template. Each line cites the log row or message it came from.

OutputA draft incident report with a cited timeline, ready for the IR lead to edit.

Threat intel to hunts

Drop in a vendor advisory or a CISA alert as a PDF. Document Lens pulls the IOCs and ATT&CK techniques. Corvic drafts a hunt for each technique you have telemetry for.

OutputAn IOC table plus draft hunts, each tagged with its ATT&CK technique ID.

Noisy rule review

A Playbook reads last week's closed tickets in Jira every Monday. It counts benign closures per analytics rule and quotes the closure notes your analysts wrote.

OutputA weekly tuning list for detection engineering, ranked by benign closures.

Questionnaires and audit evidence

Corvic answers customer security questionnaires from your policies, your SOC 2 report and past answers. Each answer links to the page and paragraph it came from, so your GRC lead checks it in one click.

OutputA questionnaire draft with a source link on every answer.

Try it

Pick a hunt and check the query yourself

Choose an investigation question. Corvic drafts the KQL, explains each clause and notes what to verify. Approve it to see results on sample telemetry from a fictional company.

1. Choose a question

Sample tenant: Harbor Point Logistics. All accounts, devices and IPs are fictional.

Draft
2Analyst review
3Results

Draft ready · 13 lines · SigninLogs

QuestionWhich IPs failed sign-ins against 10 or more accounts in the last 24 hours, and did any of them get in?

2. Read the generated KQL. Select a line for its explanation.

What line 1 do

Entra ID interactive sign-ins. Every attempt is logged here with a ResultType code.

Check before running

Shared egress IPs, like a VPN or a proxy, can look like a spray. Check the top IPs against your known egress list before you escalate.

On your data, the analyst runs it in Defender or Sentinel.

How it works

Start with the logs you already keep

Corvic connects to the stores where your logs and case data already sit. You keep your SIEM and your runbooks.

1
Connect log stores and case data
Point Corvic at where your telemetry lands, such as Azure Blob Storage exports, Elasticsearch or a Kafka topic. Add Jira and Slack for case history. Access follows permissions you set per person and per source.
2
Load your schema and saved hunts
Corvic indexes your table schemas, custom fields and the hunts your team already trusts in Virtual Memory. Drafts use your real column names and your naming conventions.
3
Analysts ask, read, then run
An analyst asks a question and gets a query with a note on each clause. They edit it and run it in their own console. Results come back to Corvic for the case timeline.

Connects to

Azure Blob Storage

AWS S3

Elasticsearch

Kafka

Snowflake

Databricks

GitHub

Jira

Slack

Microsoft 365

Research

Research with UVA on small models for KQL

Corvic's Hadi Ahmadi and the DART Lab at the University of Virginia tested whether small language models can turn analyst questions into KQL. A small model drafts the query and a low-cost model judges it against the schema. These are results from the paper. A pilot on your own schema is how you get your number.

0.987

Syntax accuracy on Microsoft's NL2KQL Defender dataset

0.906

Semantic accuracy on the same dataset

Up to 10x

Lower token cost than GPT-5

Models compared, 5 small and 4 large

As reported in Muzammil et al., Towards Small Language Models for Security Query Generation in SOC Workflows (arXiv 2512.06660, 2025).

Read the research note

How the two-stage approach works, and how it carries over to Microsoft Sentinel data.

Read the paper on arXiv

Methods, datasets and the full model comparison, including cost per 230 queries.

Compare models on your hunts

Pick the model per task, including open-source models or your own endpoint. Compare quality, latency and cost on your own hunts.

Security

Ready for your vendor security review

Your team will review us the way you review every vendor. Here is what goes in the file.

SOC 2 Type II

Corvic holds a SOC 2 Type II report. Ask for it during your vendor review.

Private VPC deployment

Deploy Corvic in a private VPC. Tenants are isolated from each other.

Your keys, encrypted data

Customer-dedicated key management. AES-256 encryption at rest and TLS 1.2+ in transit.

Zero-retention model options

Choose models with zero-data-retention options where the provider supports it. Swap models in config without rebuilding a workflow.

Access per analyst and per source

Permissions are scoped per person and per source. A Tier 1 analyst sees the sources they are cleared for and nothing else.

SSO and removal on demand

Common concerns

What SOC leads raise before a pilot

You don't have to. Corvic drafts the query and your analyst reads, edits and runs it in their own console with their own permissions. Each clause comes with a plain-English note and a flag for anything to check first.

That is the most common failure, so drafts are grounded in your indexed schema and saved hunts. The explanation names every table and column the query touches, so a wrong one stands out. In the DART Lab paper, a second model checked each draft against the schema and reached 0.906 semantic accuracy on Microsoft's Defender test set.

Deploy Corvic in a private VPC with customer-dedicated keys and tenant isolation. You choose the model, including open-source models or your own endpoint. Tell us your data residency requirements and we will scope the deployment to them.

The published research covers KQL, so that is where our evidence is today. The case grouping, intel, report and questionnaire workflows don't depend on a query language, and Corvic connects to Elasticsearch, Kafka and the storage where your logs land. Tell us your SIEM and we will show you what a pilot covers.

Every answer cites the row, page or message it came from. A reviewer can follow each timeline entry in a report back to its log event. You can also run one task across several models and compare the outputs before you pick one.

Connect each client's log store as a separate source. Permissions are scoped per person and per source, so an analyst sees only the clients they are assigned to.

You don't need one. We onboard you with your own data, and your first answer is 24 hours away. A good pilot starts with one log source and hunts your team already runs, so you can score drafts against queries you trust.

Bring 10 hunts your team already trusts

We connect one log source and draft each hunt from a plain-English question. Then we put the drafts next to your queries. Your analysts decide which ones hold up.