Construct threat hunting queries for SIEM/EDR