QUERY FOR CROWDSTRIKE

CrowdStrike Falcon, with reach across your whole stack.

Investigate, hunt, detect, and respond with the whole picture.

QUERY APP FOR CROWDSTRIKE

From detection to decision,
without leaving Falcon.

CrowdStrike Falcon® covers your endpoints, identities, cloud, exposure, and the logs you bring into Next-Gen SIEM.
The rest of the evidence that settles a detection often lives somewhere else.

How it works, start to finish

Falcon detection
High

Suspicious PowerShell download

Host
FIN-LT-0412
User
j.alvarez
Time
02:31
A Query Worker checks beyond Falcon
OktaFirst sign-in from Romania, 02:14Finding
VirusTotalDownload domain registered 6 days agoFinding
Amazon S3VPC flow logs: outbound volume normal for this hostClean
IntuneDevice compliant, checked in 3 hours agoClean
ServiceNowFinance laptop, high business criticalityContext
ProofpointTimed out. Phishing delivery not checked.Gap named
Back in Falcon

Suspicious

Confidence
Medium
Recommended
Reset credentials, isolate host
Gaps
Phishing delivery not checked

Every high and critical detection triggers the Query Investigation Worker.

The Query Worker extracts IOCs, executes searches, and gathers context across every source on your mesh.

The disposition, evidence, and any data gaps are delivered back in the Falcon console.

Every high and critical detection,
investigated before anyone opens it.

Get started

Step 1

Install the app from the Foundry App Catalog.

Step 2

Connect it to your Query account.

Step 3

Detections start arriving with investigation evidence attached.

Picture your morning queue, already triaged.

See the Query App for CrowdStrike in action, from detection to decision.

THE QUERY SECURITY DATA MESH

Security data lives everywhere.
Put all of it to work.

Every tool in your stack holds part of the answer, each with its own console and query language.
The Query Security Data Mesh reaches all of it where it lives, Falcon included.
Investigate, hunt, and detect across every source as if it were one.

Your CrowdStrike data, on the mesh

Endpoint Security

CrowdStrike Falcon®
Endpoint Security

Query reads

Detections, alerts, hosts, host groups, indicators, file hashes, and MalQuery.

Answers

Has this hash shown up on any of our hosts?

Connector docs → Next-Gen SIEM

CrowdStrike Falcon®
Next‑Gen SIEM

Query reads

Events, entities, and fields from any repository you choose.

Answers

What did this user touch across every repository?

Connector docs → Identity Security

CrowdStrike Falcon®
Next‑Gen Identity Security

Query reads

Identity sensor coverage and Zero Trust Assessment posture for your hosts.

Answers

Is this host covered by an identity sensor, and what’s its Zero Trust score?

Connector docs → Exposure Management

CrowdStrike Falcon®
Exposure Management (Spotlight)

Query reads

Vulnerability findings by CVE, CWE, host, and IP.

Answers

Which of our hosts are exposed to the CVE in today’s advisory?

Connector docs →

Every connector is read-only and works across investigations, threat hunting, detections, and automation via Query Workers. Reach your data. No engineering required.

What the mesh makes possible

Security Data Mesh

Faster, more accurate investigations

One investigation reaches every source, so the answer doesn’t depend on which console someone thought to open.

Explore the mesh →
Federated Detections

Detections on data you never had to ingest

Run detection logic where the data lives, across sources that never made it into a SIEM.

See Federated Detections →
Query Workers

AI agents that see your whole stack

Query Workers, or the agents you already run, reason over structured, normalized data from every connected source.

Meet Query Workers →
Connectors

New sources without a pipeline project

50+ pre-built and maintained connectors deliver ready-to-use data, no ingestion required.

Browse connectors →

Analysts and agents are only as good as
the data they can reach.

We gave the same AI agent the same questions across 40 security sources,
comparing results when querying each tool directly vs through the Query Security Data Mesh.

Same agent. Same question. Four times the answer.

20%

Querying each tool directly

83%

Through the Query Security Data Mesh

Share of the answer found on the broadest question we tested.

Any agent can reach your data.
The mesh is why they understand it.

Engineered to earn trust.

Authority

Every disposition is a recommendation. Your analysts decide and act.

Calibration

Each Worker output includes multi‑state classification (not binary) and explicit confidence scores.

Evidence

Each finding includes its queries and sources. Data gaps are declared, not hidden.

14 hrs

average investigation time saved per incident

“Query Workers running on the mesh changes what my team can actually do. Issues that used to take hours to investigate are pre-packaged in minutes, and my analysts are making decisions instead of chasing data.”

Rudy Ristich · CISO & CPO, Avant

See your data on the Query security data mesh.

Every source connected. Every alert investigated. Every threat hunted.