Cheat Sheet

Query Structure

QUERY [SHOW] <fields>
[WITH <filters>]
[SINCE <start time>] [UNTIL <end time>]
[FROM <connectors>]
[ORDER BY <attribute> [ASC|DESC] [, ...]]
[LIMIT <max results>]

Connector References (FROM)

Reference	Syntax	Example
Display name	Quoted string	`FROM 'Active Directory', 'Okta'`
Numeric ID / UUID	Unquoted	`FROM 1940, 2015`
Alias	Unquoted	`FROM okta-logins`
Tag (expands to all tagged connectors)	`#`-prefixed	`FROM #siem, #env/prod`

Reference types can be mixed: FROM okta-logins, #aws, 'Active Directory'. In FROM, # means a connector tag; in field selection it means an event category (#network.**).

Attribute Selectors

Selector	Meaning	Example
`.`	Direct path	`authentication.user.username`
`*`	All fields (one level)	`authentication.*`
`**`	All fields (full depth)	`authentication.**`
`#`	Category	`#network.**`
`%`	Entity (observable)	`%ip`, `%hash`, `%username`
`@`	Type filter	`@ip_t`, `@user`
`+`	Union	`(authentication + process_activity).user.name`
`-`	Difference	`authentication.(* - (start_time + end_time))`
`&`	Intersection	`A & B`
`//`	Deep expansion modifier	`#network//*`

Filter Operators

Operator	Description	Example
`=`	Equals	`status_id = FAILURE`
`==`	Equals (case-insensitive)	`user.username == 'ADMIN'`
`!=`	Not equals	`status_id != SUCCESS`
`!==`	Not equals (case-insensitive)	`user.username !== 'admin'`
`~`, `CONTAINS`	Contains substring	`cmd_line ~ 'powershell'`
`~~`, `ICONTAINS`	Contains (case-insensitive)	`cmd_line ~~ 'powershell'`
`^=`, `STARTSWITH`	Starts with	`filename ^= 'mal'`
`^==`, `ISTARTSWITH`	Starts with (case-insensitive)	`filename ^== 'Mal'`
`$=`, `ENDSWITH`	Ends with	`filename $= '.exe'`
`$==`, `IENDSWITH`	Ends with (case-insensitive)	`filename $== '.EXE'`
`IN`	In list	`status_id IN SUCCESS, FAILURE`
`IIN`	In list (case-insensitive)	`user.name IIN 'admin', 'root'`
`<`, `>`, `<=`, `>=`	Numeric comparison	`count > 5`
`EMPTY`	Field is null/empty	`user.email EMPTY`
`MATCHES`	Regex match	`cmd_line MATCHES '.*\.ps1$'`
`IMATCHES`	Regex (case-insensitive)	`cmd_line IMATCHES '.*\.ps1$'`
`CIDR`	IP in CIDR range	`src_endpoint.ip CIDR '10.0.0.0/8'`
`NOT`	Negate a filter	`NOT status_id = SUCCESS`

Combining Filters

WITH (A OR B) AND C AND NOT D

Array Quantifiers

WITH ANY field.list CONTAINS 'value'
WITH ALL field.list IN 'a', 'b'

Entity Shortcuts

Entity	Names	Searches
IP Address	`%ip`, `%ip_address`	All IP fields
Hostname	`%hostname`	All hostname fields
Username	`%username`, `%user_name`	All username fields
Email	`%email`, `%email_address`	All email fields
Hash	`%hash`, `%file_hash`	All hash fields
File Name	`%filename`, `%file_name`	All file name fields
Process Name	`%processname`, `%process_name`	All process name fields
URL	`%url`, `%url_string`	All URL fields
MAC Address	`%mac`, `%mac_address`	All MAC address fields
Port	`%port`	All port fields
Command Line	`%command_line`	All command line fields
CVE	`%cve`	All CVE ID fields

Time Syntax

SINCE = how far back to start. UNTIL = where to stop.

Relative

SINCE 48hrs UNTIL 24hrs      -- between 48 and 24 hours ago
SINCE 7d                     -- last 7 days
UNTIL 2 weeks 3 days         -- no older than 2 weeks 3 days

Units: m/min/minutes, h/hr/hrs/hours, d/day/days, w/wk/weeks, mo/month/months

Absolute

SINCE '2025-03-17'
UNTIL '2025-04-01 17:30:00'
SINCE '2025-04-01 17:30-05:00'

Epoch

UNTIL 1746109163

SUMMARIZE (Analytics)

SUMMARIZE <operation> <fields>
[WITH <filters>]
[GROUP BY <fields>]
[SINCE <time>] [UNTIL <time>]
[FROM <connectors>]

Operation	Description
`COUNT`	Count events
`COUNT DISTINCT`	Count unique values
`MIN`	Minimum value
`MAX`	Maximum value
`AVG`	Average value
`SUM`	Total value

SUMMARIZE COUNT authentication
WITH authentication.status_id = FAILURE
GROUP BY authentication.user.username
SINCE 24hrs

STATS is an alias for SUMMARIZE.

Common OCSF Event Classes

Event Class	What It Covers
`authentication`	Logins, MFA, SSO
`process_activity`	Process creation/termination
`network_activity`	Network connections/flows
`dns_activity`	DNS queries/responses
`http_activity`	HTTP requests/responses
`file_activity`	File CRUD operations
`email_activity`	Email send/receive/scan
`detection_finding`	Security alerts/detections
`account_change`	Account create/modify/delete
`api_activity`	API calls (cloud, SaaS)
`ssh_activity`	SSH sessions

Categories: #network, #iam, #findings, #application

EXPLAIN Commands

EXPLAIN VERSION                           -- FSQL and QDM versions
EXPLAIN ATTRIBUTES <selector>             -- Expand a selector to field list
EXPLAIN SCHEMA <selector>                 -- Schema definitions for fields
EXPLAIN CONNECTORS                        -- Available connectors and events
EXPLAIN QUERY <query>                     -- How FSQL interprets your query
EXPLAIN GRAPHQL QUERY <query>             -- Translate to GraphQL
VALIDATE QUERY <query>                    -- Check query validity