Falcon App Setup and Administration
Install the app, connect it to your Query tenant, and turn on automatic investigations
TL;DRInstall from the App catalog and enter your Query API token and regional host. There are two credentials to fill in — one for search, one for Workers.
Verify with
EXPLAIN VERSIONfrom the Query panel.Automatic investigation is off until you provision the workflow, which needs the Workflow Author role.
Prerequisites
- A Query API token and your Query regional host (for example
api.query.ai). Useapi.eu.query.aiif you are in EU. - Falcon Administrator to install.
- Workflow Author, additionally, to turn on automatic investigations.
The API token grants access to every source on your mesh. It is stored by Falcon as an API integration credential, never in the app's code or manifest.
Install
- Foundry → App catalog.
- Search for Query Security Data Mesh.
- Install, review the permissions, and confirm.
Configure Credentials
Credentials are collected during install. The app has two API integrations:
| Integration | Used by |
|---|---|
| Query FSQL API | The panel's search tab and the Fusion SOAR action |
| Query Workers API | Worker investigations, automatic and manual |
Enter the same token and host in both unless your Query administrator issued separate ones.
Verify
Open any endpoint detection, expand the Query.AI panel, and on the Federated Search tab run:
EXPLAIN VERSIONIt returns the FSQL and data model versions from the Query service, proving token, host, and connectivity without touching a connector.
To check the Workers integration, start an investigation from the Worker Investigation tab. A console link within a second or two means the launch succeeded.
Turn On Automatic Investigations
- Next-Gen SIEM → Fusion SOAR → Workflows.
- Find the workflow provided by the app.
- Set the severity condition to the detections you want investigated.
- Set Status to On.
Publishing and enabling are separate actions — a workflow can be published and still switched off, which is the safe state while tuning the condition.
Every matching detection spends an agentic investigation against your Query tenant. High and Critical is a sensible starting point.
Rotating the API Token
Update credentials from the App catalog, on the installed app's entry — not App manager, and not the API integrations page. The credential belongs to the app's configuration, which lives with the installation.
Update both integrations. No deploy or release is needed; the new token applies on the next call. Re-verify both halves afterwards.
Roles
| Task | Role |
|---|---|
| Install, configure, rotate credentials | Falcon Administrator |
| Enable the investigation workflow | Workflow Author, in addition |
| Use the panel | Whatever grants access to the record |
Troubleshooting
| Symptom | Cause |
|---|---|
| Search or investigations stop working after a token rotation | Confirm both integrations were updated |
| Searches time out | A search must finish in 30 seconds. Narrow the window, pin one entity, use a LIMIT. |
| No panel on a full-page record view | Expected — the panel renders in detail flyouts |
| "No entity detected on this record" | The record identifies its selection only by an internal id. Use the manual entity field. |
| Panel shows a previous version after an update | Hard reload the Falcon page (⌘⇧R) |
What's Next
- Auto-Investigating Detections
- Investigating from the Falcon Console
Updated about 16 hours ago