Query for CrowdStrike Falcon
Investigate detections against every connected source, without leaving Falcon
TL;DRThe app investigates detections as they fire. A Query Worker searches every source connected to the Query Security Data Mesh, and the report is waiting in the Falcon console when an analyst opens the detection.
It also adds an ad-hoc federated search panel to detections, cases, and hosts, and a Fusion SOAR action for running FSQL from any workflow.
Installed from the Falcon App catalog by a Falcon Administrator. Requires a Query subscription and API token.
Automatic Investigation
Detection fires
└─ Fusion SOAR workflow (severity condition)
└─ Query Worker investigates across the mesh
└─ Report appears in the Query.AI panel on that detectionThe workflow launches the investigation and exits; the Worker runs on its own clock while the alert sits in the queue. The app records a pointer to the investigation, not a copy of the report, so the panel always shows its current state.
The workflow ships with the app but is off until you provision it. See Auto-Investigating Detections.
Federated Search on a Record
The Query.AI panel reads the entities off a record — account, hostname, IP — and searches every source that maps them. Entity selectors do the work, so you don't need to know where a username lives in each product:
QUERY ** WITH %username = 'jdoe' SINCE 1h LIMIT 10Results show the source platform per row, with a link through to the unbounded result set in the Query console.
Federated Search in Workflows
The same search is available as a Fusion SOAR action, so any workflow can run FSQL and use the results downstream.
Where the Panel Appears
The panel renders in Falcon's detail flyouts, not in full-page record views. This applies to all Foundry apps.
| Surface | Panel |
|---|---|
| Endpoint detections | Yes |
| Identity detections | Yes |
| Next-Gen SIEM cases | Yes, including the Workbench tab |
| Host management hosts | Yes |
| Leads | Yes |
| Workflow executions | Yes |
| Full-page record views | No |
Scope and Access
- Read-only. Only non-mutating FSQL is accepted —
QUERY,SUMMARIZE,ANALYZE,STATS,EXPLAIN,VALIDATE,EXPAND. - No Falcon API scopes requested. The app reads the record it renders on and writes nothing back.
- Your Query API token and regional host are entered at install and held by Falcon as an API integration credential.
What's Next
- Falcon App Setup and Administration
- Auto-Investigating Detections
- Investigating from the Falcon Console
- Running Federated Search from Fusion SOAR
Updated about 16 hours ago