Running Federated Search from Fusion SOAR
Run FSQL against every connected source from a Fusion workflow
TL;DRThe app exposes federated search as a Fusion SOAR action. It is read-only, returns rows plus flags telling you whether the result was complete, and must finish within 30 seconds.
Adding the Action
- Next-Gen SIEM → Fusion SOAR → Workflows, create or edit a workflow.
- Add the federated search action provided by the Query app.
- Supply the FSQL statement, and optionally a maximum row count.
Reference trigger fields with the workflow's data pills, so a detection's hostname or hash flows into the statement.
Use the pills rather than typing referencesA mistyped data reference does not error — it is stored as a literal string and the workflow runs with it.
What You Can Run
Non-mutating statements only, such as: QUERY, SUMMARIZE, ANALYZE, ...
QUERY authentication.** WITH %username = 'jdoe' SINCE 6h LIMIT 20What It Returns
For a QUERY, the matched events plus:
| Output | Meaning |
|---|---|
| Row count | Events returned |
| Sources | Distinct platforms that contributed |
| Unattributed rows | Rows whose source could not be determined from the event |
| Truncated | Whether the result was capped |
| Total rows available | How many existed when it was capped |
| Partial | Whether some connectors failed while others succeeded |
| Search and trace ids | For correlating with Query platform logs |
EXPLAIN and other non-QUERY commands return their payload directly rather than as rows.
Branch onpartialif the workflow makes decisions from the result. A search can succeed and still be incomplete.
Limits
30 seconds per call, which is a Fusion SOAR limit. To stay within the limits, you can bound the time to a narrow window, pin an entity, and use a LIMIT (the search returns as soon as the limit is satisfied from any source, so it bounds latency as well as payload). Note that omitting a time clause searches the last 24 hours.
LIMIT only shortens a search where matches are plentiful; a selective predicate over a sparse window can still run long. Narrow the time window instead.
Row cap. Bounds what the action returns, not what the query executes — a LIMIT clause is still the way to bound the search itself. When the cap trims a result, the action reports how many rows were available.
Response size. Falcon limits response sizes to toughly 1 MB. A broad OCSF event could be large; hence the action trims to fit (and says so).
Example Patterns
- On case creation, search recent authentication activity for the named account and attach the result.
- After a detection fires, search connected threat-intelligence sources for the hash and branch on the outcome.
- Search
network_activityfor the host named on a detection over the preceding hours.
For several lines of inquiry and a written conclusion, use an agentic investigation instead — see Auto-Investigating Detections.
What's Next
Updated about 2 hours ago