Cheat Sheet

Single-page FSQL quick reference

Query Structure

QUERY [SHOW] <fields>
[WITH <filters>]
[SINCE <start time>] [UNTIL <end time>]
[FROM <connectors>]
[ORDER BY <attribute> [ASC|DESC] [, ...]]
[LIMIT <max results>]

Connector References (FROM)

Reference	Syntax	Example
Display name	Quoted string	`FROM 'Active Directory', 'Okta'`
Numeric ID / UUID	Unquoted	`FROM 1940, 2015`
Alias	Unquoted	`FROM okta-logins`
Tag (expands to all tagged connectors)	`#`-prefixed	`FROM #siem, #env/prod`

Reference types can be mixed: FROM okta-logins, #aws, 'Active Directory'. In FROM, # means a connector tag; in field selection it means an event category (#network.**).

Attribute Selectors

Selector	Meaning	Example
`.`	Direct path	`authentication.user.username`
`*`	All fields (one level)	`authentication.*`
`**`	All fields (full depth)	`authentication.**`
`#`	Category	`#network.**`
`%`	Entity (observable)	`%ip`, `%hash`, `%username`
`@`	Type filter	`@ip_t`, `@user`
`+`	Union	`(authentication + process_activity).user.name`
`-`	Difference	`authentication.(* - (start_time + end_time))`
`&`	Intersection	`A & B`
`//`	Deep expansion modifier	`#network//*`

Filter Operators

Operator	Description	Example
`=`	Equals	`status_id = FAILURE`
`==`	Equals (case-insensitive)	`user.username == 'ADMIN'`
`!=`	Not equals	`status_id != SUCCESS`
`!==`	Not equals (case-insensitive)	`user.username !== 'admin'`
`~`, `CONTAINS`	Contains substring	`cmd_line ~ 'powershell'`
`~~`, `ICONTAINS`	Contains (case-insensitive)	`cmd_line ~~ 'powershell'`
`^=`, `STARTSWITH`	Starts with	`filename ^= 'mal'`
`^==`, `ISTARTSWITH`	Starts with (case-insensitive)	`filename ^== 'Mal'`
`$=`, `ENDSWITH`	Ends with	`filename $= '.exe'`
`$==`, `IENDSWITH`	Ends with (case-insensitive)	`filename $== '.EXE'`
`IN`	In list	`status_id IN SUCCESS, FAILURE`
`IIN`	In list (case-insensitive)	`user.name IIN 'admin', 'root'`
`<`, `>`, `<=`, `>=`	Numeric comparison	`count > 5`
`EMPTY`	Field is null/empty	`user.email EMPTY`
`MATCHES`	Regex match	`cmd_line MATCHES '.*\.ps1$'`
`IMATCHES`	Regex (case-insensitive)	`cmd_line IMATCHES '.*\.ps1$'`
`CIDR`	IP in CIDR range	`src_endpoint.ip CIDR '10.0.0.0/8'`
`NOT`	Negate a filter	`NOT status_id = SUCCESS`

String Literals

Quote string values with either '...' or "..." (equivalent). The other quote is a literal inside a string; backslash escapes the delimiter. Enum tokens and numbers stay unquoted.

WITH file.message = "it's here"   -- other quote is literal
WITH file.message = 'a\'b'        -- backslash escapes the delimiter

Combining Filters

WITH (A OR B) AND C AND NOT D

Array Quantifiers

WITH ANY field.list CONTAINS 'value'
WITH ALL field.list IN 'a', 'b'

Entity Shortcuts

Entity	Names	Searches
IP Address	`%ip`, `%ip_address`	All IP fields
Hostname	`%hostname`	All hostname fields
Username	`%username`, `%user_name`	All username fields
Email	`%email`, `%email_address`	All email fields
Hash	`%hash`, `%file_hash`	All hash fields
File Name	`%filename`, `%file_name`	All file name fields
Process Name	`%processname`, `%process_name`	All process name fields
URL	`%url`, `%url_string`	All URL fields
MAC Address	`%mac`, `%mac_address`	All MAC address fields
Port	`%port`	All port fields
Command Line	`%command_line`	All command line fields
CVE	`%cve`	All CVE ID fields

Time Syntax

SINCE = how far back to start. UNTIL = where to stop.

Relative

SINCE 48hrs UNTIL 24hrs      -- between 48 and 24 hours ago
SINCE 7d                     -- last 7 days
UNTIL 2 weeks 3 days         -- no older than 2 weeks 3 days

Units: m/min/minutes, h/hr/hrs/hours, d/day/days, w/wk/weeks, mo/month/months

Absolute

SINCE '2025-03-17'
UNTIL '2025-04-01 17:30:00'
SINCE '2025-04-01 17:30-05:00'

Epoch

UNTIL 1746109163

SUMMARIZE (Analytics)

SUMMARIZE <operation> <fields>
[WITH <filters>]
[GROUP BY <fields>]
[SINCE <time>] [UNTIL <time>]
[FROM <connectors>]

Operation	Description
`COUNT`	Count events
`COUNT DISTINCT`	Count unique values
`MIN`	Minimum value
`MAX`	Maximum value
`AVG`	Average value
`SUM`	Total value

SUMMARIZE COUNT authentication
WITH authentication.status_id = FAILURE
GROUP BY authentication.user.username
SINCE 24hrs

STATS is an alias for SUMMARIZE.

Common OCSF Event Classes

Event Class	What It Covers
`authentication`	Logins, MFA, SSO
`process_activity`	Process creation/termination
`network_activity`	Network connections/flows
`dns_activity`	DNS queries/responses
`http_activity`	HTTP requests/responses
`file_activity`	File CRUD operations
`email_activity`	Email send/receive/scan
`detection_finding`	Security alerts/detections
`account_change`	Account create/modify/delete
`api_activity`	API calls (cloud, SaaS)
`ssh_activity`	SSH sessions

Categories: #network, #iam, #findings, #application

EXPLAIN Commands

EXPLAIN VERSION                                      -- FSQL and QDM versions
EXPLAIN [MASKED|UNMASKED] ATTRIBUTES <selector>      -- Expand a selector to a field list
EXPLAIN SCHEMA <selector> [WITH|WITHOUT NULLS]       -- Schema definitions for fields
EXPLAIN ENTITIES                                     -- Entity shortcuts (%ip, %username, ...)
EXPLAIN [ACTIVE|ALL|DISABLED] CONNECTORS [<conns>]   -- Connectors and their events (default: active)
EXPLAIN DETECTIONS [LIKE '<pattern>']                -- Detections in the tenant
EXPLAIN CATALOG [<selector>] [FROM <conns>]          -- What's actually mapped in your data
EXPLAIN [AST|EXPANDED] QUERY <query>                 -- How FSQL interprets your query
EXPLAIN MANUAL [FOR AI]                              -- This documentation
VALIDATE QUERY <query>                               -- Check query validity

Permission & Group Management

The mutating statements are tenant-admin only. See Permission Commands for the full reference.

GRANT <verb> [ON <resource>] TO USER|GROUP <identity>       -- grant a permission
REVOKE <verb> [ON <resource>] FROM USER|GROUP <identity>    -- revoke a permission (idempotent)
EXPLAIN GRANTS [ON <resource>] [TO USER|GROUP <identity>]   -- list grants
EXPLAIN GROUPS [LIKE '<pattern>']                           -- list groups (entra + query)

CREATE GROUP '<name>'                                       -- create a query-native group (not idempotent)
RENAME GROUP [source:]<name> TO '<new-name>'                -- rename a query-native group
DROP GROUP [source:]<name>                                  -- delete a query-native group (fails if it has active grants)
ADD USER <email> TO GROUP [source:]<name>                   -- add a member to a query-native group
REMOVE USER <email> FROM GROUP [source:]<name>              -- remove a member (idempotent)
EXPLAIN MEMBERS OF [source:]<name>                          -- list a group's members (entra + query)

entra:-sourced groups are read-only everywhere except EXPLAIN MEMBERS OF — CREATE/RENAME/DROP GROUP and ADD/REMOVE USER only work on query: groups.

Updated 9 days ago

Did this page help you?