Welcome to the Falcon Query Assets GitHub page. Here, we will publish useful queries, transforms, and tips that help CrowdStrike customers write custom hunting syntax and better leverage the Falcon telemetry stream.
- Event field transforms for telemetry in Event Search (FQL) and Falcon Long Term Repository (HQL) language.
- Useful lookup tables for Event Search.
To report errors or corrections, please file an Issue using GitHub.
This page will be perpetually under construction.
2022-09-07 - Git made public. First release of 85+ field transforms for Event Search and Falcon Long Term Repository. Published list of helpful lookup tables for Falcon Event Search.