LogScale Queries

Category

Investigation & Troubleshooting

Analysis of incidents and technical issues

16 published queries

Categories

query.txt
in(field="#windows.EventID", values=[4732,4728,4756,4729,4733,4757])
| case {
	in(field="#windows.EventID", values=[4732,4728,4756]) | action:= "added";
	in(field="#windows.EventID", values=[4733,4729,4757]) | action:= "removed";

Track every Active Directory group membership change

v1

Show every addition to and removal from Active Directory global, local, and universal groups. Use it to investigate a time window or confirm that Windows Security group-membership events are reaching LogScale. Source: the blog article “5 LogScale queries to audit Active Directory group changes” — https://it-selig.de/blog/logscale-queries-ad-group-changes

LogScaleInvestigation & TroubleshootingActiveDirectoryInvestigationMonitoring+1

@sebastian · 2.8.2026

DownloadOpen
query.txt
// Get ReflectiveDotnetModuleLoad with non-null ManagedPdbBuildPath field.
#event_simpleName=ReflectiveDotnetModuleLoad event_platform=Win ManagedPdbBuildPath!=""

// Capture FilePath and FileName Fields

Hunt PBD File Paths in Reflective .net Module Loads

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Hunt PBD File Paths in Reflective .net Module Loads.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Hunt%20PBD%20File%20Paths%20in%20Reflective%20.net%20Module%20Loads.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation+2

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get uninstall and heartbeat events
#event_simpleName=AcUninstallConfirmation OR #event_simpleName=SensorHeartbeat

// Narrow dataset by Agent ID; check both events happen on a single system

Check for Falcon AcUninstallConfirmation Event Followed by no Heartbeat Events

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Check for Falcon AcUninstallConfirmation Event Followed by no Heartbeat Events.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check%20for%20Falcon%20AcUninstallConfirmation%20Event%20Followed%20by%20no%20Heartbeat%20Events.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation+1

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=SensorHeartbeat
| groupBy([aid], function=selectLast([@timestamp, ComputerName, SensorStateBitMap]), limit=max)
| bitfield:extractFlags(
field=SensorStateBitMap,

Check for RTR Being Disabled

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Check for RTR Being Disabled.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check%20for%20RTR%20Being%20Disabled.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation+1

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Fleshed out query for clickfix detection

#event_simpleName=ProcessRollup2 
| #repo=base_sensor

ClickFixHunting

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/ClickFixHunting.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/ClickFixHunting.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation+2

@sebastian · 25.7.2026

DownloadOpen
query.txt
#repo=sensor_metadata
#data_source_name=aid-policy
| parseJson(field=groups, prefix=groups_arr)
| concatArray(groups_arr, separator=",", as=groups_arr)

Map Agent ID values to Host Group Names

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Map Agent ID values to Host Group Names.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Map%20Agent%20ID%20values%20to%20Host%20Group%20Names.md

LogScaleInvestigation & TroubleshootingDetectionInvestigationTroubleshooting

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=DetectionExcluded ExclusionSource=6
| PatternId =~ match(file="falcon/investigate/detect_patterns.csv", column=PatternId, strict=false)
| case {
    ExclusionType=1 | ExclusionType_Readable:="IOA" | Detail:=CommandLine;

Profiling IOC and IOA Exclusions in Falcon

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Profiling IOC and IOA Exclusions in Falcon.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Profiling%20IOC%20and%20IOA%20Exclusions%20in%20Falcon.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation+1

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=ProcessRollup2 event_platform=Win
// Add in additional program names here.
| in(field="FileName", values=[anydesk.exe, AteraAgent.exe, teamviewer.exe, SRService.exe, SRManager.exe, SRServer.exe, SRAgent.exe, ClientService.exe, "ScreenConnect.WindowsClient.exe", ngrok.exe], ignoreCase=true)
| FilePath=/\\Device\\HarddiskVolume\d\\(?<ShortFilePath>.+$)/

RMM Tool Hunting

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/RMM Tool Hunting.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/RMM%20Tool%20Hunting.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation+2

@sebastian · 25.7.2026

DownloadOpen
query.txt
(#event_simpleName=/^(SystemCapacity|ResourceUtilization)$/) OR (#repo=sensor_metadata #data_source_name=aidmaster)
| case {
    event_platform=Lin | ProductType:=3;
    event_platform=Mac | ProductType:=1;

Resource Utilization

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Resource Utilization.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Resource%20Utilization.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation+2

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get all sensor heartbeat events
#event_simpleName=SensorHeartbeat

// Get last event for each Agent ID value

Sensors without Heartbeat Event in 20 Minutes

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Sensors without Heartbeat Event in 20 Minutes.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Sensors%20without%20Heartbeat%20Event%20in%2020%20Minutes.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation+1

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/^(SystemCapacity|ResourceUtilization)$/

| groupBy(aid, function=([selectLast([CpuProcessorName, PhysicalCoreCount, LogicalCoreCount, AverageCpuUsage, MemoryTotal, MaxUsedRam, AverageUsedRam, MaxUsedRam, AvailableDiskSpace])]))
| CpuProcessorName=* AND AvailableDiskSpace=*

SystemCapacity & ResourceUtilization

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/SystemCapacity & ResourceUtilization.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/SystemCapacity%20%26%20ResourceUtilization.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation+1

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get two events of interest
event_platform=Win #event_simpleName=/^(UserAccountAddedToGroup|ProcessRollup2)$/ 

// Begin data normalization

User Added to Group

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/User Added to Group.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/User%20Added%20to%20Group.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation+2

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get RTR Start events
#repo=detections #event_simpleName=Event_RemoteResponseSessionStartEvent

// Rename Agent ID value

View Recent RTR Sessions

v1

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/View Recent RTR Sessions.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/View%20Recent%20RTR%20Sessions.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation+1

@sebastian · 25.7.2026

DownloadOpen
query.txt
#event_simpleName=/(OsVersionInfo|ConfigStateUpdate|SensorHeartbeat)/

| event_platform=Lin
| groupBy([cid, aid], function=([selectLast([ConfigStateData, OSVersionString, SensorStateBitMap])]))

Linux Sensors in Kernel Mode, User Mode, and RFM

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Linux Sensors in Kernel Mode, User Mode, and RFM.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Linux%20Sensors%20in%20Kernel%20Mode%2C%20User%20Mode%2C%20and%20RFM.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation+2

@sebastian · 24.7.2026

DownloadOpen
query.txt
// Look for process handles opening Falcon
#event_simpleName=FalconProcessHandleOpDetectInfo FileName="WerFaultSecure.exe"

// Check for command line switching signal

Hunting EDR Freeze

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Hunting EDR Freeze.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Hunting%20EDR%20Freeze.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation+2

@sebastian · 24.7.2026

DownloadOpen
query.txt
#event_simpleName=AssociateTreeIdWithRoot
| PatternId =~ match(file="falcon/investigate/detect_patterns.csv", column=PatternId, strict=false)
| select([@timestamp, aid, ComputerName, PatternId,name,scenario,scenarioFriendly,description,severity,show_in_ui,killchain_stage,tactic,technique,objective,pattern_updated])

AssociateTreeIdWithRoot to Pattern Details

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/AssociateTreeIdWithRoot to Pattern Details.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/AssociateTreeIdWithRoot%20to%20Pattern%20Details.md

LogScaleInvestigation & TroubleshootingDetectionInvestigationTroubleshooting

@sebastian · 24.7.2026

DownloadOpen