CQL Hub

CrowdStrike Query Library

CQL Hub - CrowdStrike Query Library

Open library of detection & hunting queries for Falcon NextGen SIEM and LogScale.

Powered by

Filter by Tag:

All Tags ▼

Filter by MITRE ID:

All MITRE IDs ▼

Filter by Log Source:

All Log Sources ▼

Filter by Required Module:

All Modules ▼

0 queries found

Show:

12 per page ▼

4 per page

8 per page

12 per page

16 per page

All

Sort by:

Created (newest first) ▼

Created (newest first)

Created (oldest first)

Falcon Region:

Select Region ▼

Select Region

US1

US2

EU1

Showing 1-12 of 50 queries

×

Contribute

×

How to Contribute:

Want to share your own query?

Use this form to create a new query.
Click Submit Query to send it directly for review, or Download YAML to submit it manually via a GitHub Pull Request.
After approval, your query will appear here on CQL Hub.

Name *

Author *

MITRE ATT&CK IDs Separate multiple MITRE IDs with commas

Description *

CQL Query *

Explanation

Tags

Hunting Monitoring Detection

Log Sources

Endpoint Network Identity Cloud Mail Other

Required Modules

Insight Identity Spotlight CSPM / ASPM / DSPM Data Protection IT Automation

© 2026 ByteRay GmbH. Built for the security community.