Contribute a query

Submit a CQL query or a CSV lookup file directly below, no GitHub account required. We review every submission, test it against live data, and publish it to the hub and the open repository, credited to you as the author.

Direct submit

Query name *

What it detects *

CQL query *

Explanation optional

Markdown is supported: ## headings, **bold**, backtick code, lists, tables. This becomes the explanation section on the query page.

Tags

Hunting

Monitoring

Detection

MITRE ATT&CK IDs

Log sources

Endpoint

Network

Identity

Cloud

Mail

Other

Required Falcon modules optional

Insight

Identity

Spotlight

CSPM / ASPM / DSPM

Data Protection

IT Automation

Your name *

Email optional

GitHub handle optional

Submissions are published under the repository's license and credited to you as the author. Contact details stay private and are only used for questions during review.

Thank you — your query is in review. We'll reach out if we have questions, and you'll find it in the hub once it's published, credited to you.

Something went wrong while submitting. Please try again — or open a pull request on GitHub instead.

A lookup file is a CSV you reference from a query with match(), for example a list of Tor exit nodes or known cloud IP ranges. Upload the file, tell us what is in it, and we handle format, naming and publication.

CSV file *

Upload File

Max file size 10MB.

Uploading...

fileuploaded.jpg

Upload failed. Max size for files is 10 MB.

Preview first rows

What the file contains *

Source optional

Update cadence optional

Your name *

Email optional

Thank you, your lookup file is in review. We check the contents and the format, then publish it on the hub and in the Foundry app lookup sync, credited to you.

Something went wrong while submitting. Please try again, or open a pull request on GitHub instead.

How it works

1You submit your query with a short description of what it detects.

2We review it and validate it against live Falcon Next-Gen SIEM data.

3It goes live in the hub and the GitHub repository — with your name on it.

Prefer a pull request?

The library lives on GitHub. Fork the repo, add your query as YAML and open a PR — every submission is validated automatically.

Open the repository ↗Read the contribution guide ↗

How it works

1You upload the CSV and say what is in it and where it comes from.

2We check contents, columns and format, and normalise the file name.

3It goes live on the hub with a table preview and joins the daily lookup sync of our certified Foundry app, with your name on it.

What makes a good lookup file

A header row with clear column names, one entry per row, no empty columns. Under 10 MB, and named after its use case so a query author can tell at a glance what match() will hit.

Open the repository ↗