For Falcon Next-Gen SIEM, Falcon LogScale and the Falcon API · Coming soon

Practise and learn CrowdStrike Falcon CQL and FQL

CrowdStrike Falcon uses two languages for two different jobs. CQL, the CrowdStrike Query Language, searches and counts events in Falcon Next-Gen SIEM and LogScale. FQL, the Falcon Query Language, filters lists like hosts and detections in the Falcon console and API. The CrowdStrike track on SOC Fluent is coming soon.

Get told when it’s ready See what else is coming

FALCON · CQL

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/outlook\.exe$/i
| FileName=/^(powershell|cmd)\.exe$/i

What it looks like

Event and field names come from Falcon’s event data. Check them in your own tenant.

Which accounts had the most failed sign-ins?

FALCON · CQL

#event_simpleName=UserLogonFailed2
| groupBy([UserName])
| sort(_count, limit=10)

List the Windows hosts whose names start with WS.

FALCON API · FQL

platform_name:'Windows'+hostname:'WS*'

Where you’ll use it

Falcon Next-Gen SIEMEvent search, written in CQL.
Falcon LogScaleLog search, written in CQL.
Falcon console and APIList filters, written in FQL.

Worth knowing before you start

CQL and FQL aren’t the same language. CQL searches events, and FQL filters lists of things like hosts and detections.
In CQL, groupBy() counts by default and puts the result in a field called _count.
CQL’s sort() returns 200 rows unless you set limit, and sorts descending unless you say otherwise.
In CQL, add /i to a regex to ignore case, like FileName=/cmd\.exe/i.
In FQL, + means AND and , means OR. Exact matches in square brackets, like hostname:['WS01'], are case-sensitive.

While you wait

Be first to practise CrowdStrike Falcon CQL and FQL

Join the waitlist and pick CrowdStrike Falcon (CQL and FQL) as the language you want to practise first. We’ll tell you when the track is ready.

Join the waitlist See pricing

Free to join. Students get 50% off at launch.