Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
278 changes: 278 additions & 0 deletions .claude/runtime/metrics/post_tool_use_metrics.jsonl

Large diffs are not rendered by default.

26 changes: 17 additions & 9 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,10 @@ Cypher-to-KQL translator for Microsoft Sentinel, enabling graph query capabiliti

## Overview

Yellowstone translates Cypher graph queries into KQL (Kusto Query Language) for Microsoft Sentinel. Security analysts can use familiar graph query syntax to investigate relationships between entities like users, devices, and security events.
Yellowstone translates graph queries (Cypher and Gremlin) into KQL (Kusto Query Language) for Microsoft Sentinel. Security analysts can use familiar graph query syntax to investigate relationships between entities like users, devices, and security events.

**Supported Languages**: Cypher, Gremlin
**Status**: Core translation functional for both languages.

## Quick Start

Expand All @@ -30,17 +33,22 @@ pip install -e .
### Basic Usage

```python
from yellowstone.parser import parse_cypher
from yellowstone.translator import CypherToKQLTranslator
from yellowstone.models import CypherQuery, TranslationContext
from yellowstone.main_translator import CypherTranslator

# Works with both Cypher and Gremlin
cypher_query = "MATCH (u:User) WHERE u.age > 25 RETURN u.name"
gremlin_query = "g.V().hasLabel('User').has('age',gt(25)).values('name')"

# Parse Cypher query
cypher = "MATCH (u:User)-[:LOGGED_IN]->(d:Device) WHERE u.age > 25 RETURN u.name"
ast = parse_cypher(cypher)
translator = CypherTranslator()
context = TranslationContext(user_id="analyst", tenant_id="org", permissions=[])

# Translate to KQL
translator = CypherToKQLTranslator()
result = translator.translate(ast)
# Translate Cypher
result = translator.translate(CypherQuery(query=cypher_query), context)
print(result.query)

# Translate Gremlin (automatically detected)
result = translator.translate(CypherQuery(query=gremlin_query), context)
print(result.query)
```

Expand Down
Loading
Loading