CrowdStrike

Query Language

Cheatsheet

The building blocks of the CrowdStrike Query Language on one page: filters, functions and query patterns for Falcon Next-Gen SIEM and LogScale. A compact reference for threat hunting, detection engineering and incident response.

Filter and search

Field filters, operators, wildcards and regular expressions that pull the relevant events out of large data sets.

Aggregate and analyze

groupBy, count, table and timeChart: raw events become statistics, time series and overviews for hunting and reporting.

Correlate and enrich

Link queries and enrich hits with context from lookup files, as the basis for detections and correlation rules.