ByteRay is a German cybersecurity company for Managed Detection & Response, Digital Forensics & Incident Response and Next-Gen SIEM — specialised in the CrowdStrike Falcon platform. BSI-listed, based in Munich.
© 2026 ByteRay GmbH
The whole hub, inside your Falcon console
ByteRay CQL Hub is a certified Foundry app in the official CrowdStrike App Catalog. It brings lookup files straight into Falcon, plus correlation-rule checks you won't find anywhere else.
◉ Certified app
Use case: Threat intelligence
Authored by ByteRay GmbH
Current version: v1.6.5
Open in Falcon App Catalog ↗
The link follows your region selection (EU-1 · US-1 · US-2). Requires Falcon Next-Gen SIEM.
The library, in your console
Curated lookup files like Tor exit nodes, generative-AI domains and cloud IP ranges can be selected with a toggle and sync into Next-Gen SIEM automatically every day.
Drift Checker
A correlation rule created from a CrowdStrike template is a one-time copy. When the template improves, your rule never hears about it. The Drift Checker compares the two and shows, line by line, what has diverged.
Duplicate Checker
A template can spawn any number of rules, sometimes intentional, often overlooked duplication. The Duplicate Checker groups rules that run the same logic more than once, so they can be reviewed and consolidated.
Install in three steps
1
Open Foundry › App catalog in your Falcon console.
2
Find ByteRay CQL Hub and select Install now.
3
Grant the requested permissions — the app runs entirely inside your console. No data leaves your Falcon environment.
Need an app Falcon doesn't have?
We build custom Foundry apps for clients — in Python and Go, from requirements workshop to handover in about four weeks.
Foundry app development by ByteRay →