What changed in the CQL Hub — new queries, lookup files and Foundry app releases. Updated as we ship.
Both Correlation Rules capabilities are now fully implemented: the Drift Checker compares your correlation rules line by line against the CrowdStrike templates they were created from, and the Duplicate Checker groups rules that run the same logic more than once.
First certified release in the official CrowdStrike Foundry App Catalog, republished after CrowdStrike's review. Certified means reviewed by CrowdStrike and released to all Falcon customers — not self-published.
Current state of the open library: 174 CQL queries for CrowdStrike Falcon Next-Gen SIEM and 15 maintained lookup files — from Tor exit nodes to cloud provider IP ranges. Free to use, contributions welcome.
Every change is versioned in the open repository — the full history lives on GitHub.
