The whole hub, inside your Falcon console
ByteRay CQL Hub is a certified Foundry app in the official CrowdStrike App Catalog. It brings the query library and its lookup files straight into Falcon — plus correlation-rule checks you won't find anywhere else.
◉ Certified app
Use case: Threat intelligence
Authored by ByteRay GmbH
Current version: v1.6.5
The library, in your console
Browse and use the CQL Hub — 174 queries and counting — without leaving Falcon. Curated lookup files like Tor exit nodes, generative-AI domains and cloud IP ranges can be selected with a toggle and sync into Next-Gen SIEM automatically every day.
Drift Checker
A correlation rule created from a CrowdStrike template is a one-time copy — when the template improves, your rule never hears about it. The Drift Checker compares the two and shows, line by line, what has diverged.
Duplicate Checker
A template can spawn any number of rules — sometimes intentional, often overlooked duplication. The Duplicate Checker groups rules that run the same logic more than once, so they can be reviewed and consolidated.
Install in three steps
1
Open Foundry › App catalog in your Falcon console.
2
Find ByteRay CQL Hub and select Install now.
3
Grant the requested permissions — the app runs entirely inside your console. No data leaves your Falcon environment.
Need an app Falcon doesn't have?
We build custom Foundry apps for clients — in Python and Go, from requirements workshop to handover in about four weeks.
Foundry app development by ByteRay →
