Describe the feature:

Requesting the implementation of an UPPER() function in KQL to be applied to fields, converting the record content to all uppercase.

UPPER(url.original):*SELECT*

KQL currently lacks a mechanism to perform case-insensitive searches. When using Kibana for system log analysis, attackers can evade detection by mixing case in data that would show up in web logs. For example, a search to identify a SQL injection attack utilizing the SQL UNION keyword might be:

url.original:*UNION*

An attacker who constructs an attack where the HTTP request uses the SQL keyword UnioN would evade detection with this KQL query.

Describe a specific use case for the feature:

• Ease of use: Analysts can construct KQL queries without knowing the case expectation by converting content to uppercase as desired.
• Log analysis: Analysts can search for keywords to identify evidence of an attack in system logs while mitigating the opportunity for an adversary to evade detection through mixed case use.

Thank you for your consideration.

-Josh