ByteRay CQL Hub

Release notes

What changed in the CQL Hub: new queries, lookup files and Foundry app releases. Updated as we ship.

August 15, 2026
CQL Hub

New hub infrastructure, Markdown copy and query embeds

Traffic outgrew the old setup, so the CQL Hub has been rebuilt. Pages are now pre-rendered and delivered over a CDN instead of being assembled in the browser, which makes the library faster to open, search and filter. Two additions ship with the rewrite: every query can be copied as Markdown for tickets and documentation, and any hub page can be embedded as an iframe, so a full, always-current page runs inside your own wiki or documentation.

June 8, 2026
Foundry app

ByteRay CQL Hub v1.6.5

Both Correlation Rules capabilities are now fully implemented: the Drift Checker compares your correlation rules line by line against the CrowdStrike templates they were created from, and the Duplicate Checker groups rules that run the same logic more than once.

March 18, 2026
Foundry app

ByteRay CQL Hub v1.3.0 — certified release

First certified release in the official CrowdStrike Foundry App Catalog, republished after CrowdStrike's review. Certified means reviewed by CrowdStrike and released to all Falcon customers — not self-published.

Ongoing
Library

174 queries, 15 lookup files

Current state of the open library: 174 CQL queries for CrowdStrike Falcon Next-Gen SIEM and 15 maintained lookup files — from Tor exit nodes to cloud provider IP ranges. Free to use, contributions welcome.

Every change is versioned in the open repository — the full history lives on GitHub.