Learn about CQL

Learn CrowdStrike Query Language to search, analyze, and visualize your data

Workflow 1

Crowdstrike Query Languages Fundamentals

Start with the fundamentals

Begin with CQL basics, understand query structure, learn fundamental concepts, and build a strong foundation before writing complex queries. Perfect for those new to log querying.

  • What is CQL?
  • Query Structure & Syntax
  • Core Concepts (Events, Fields, Tags)
  • Your First Queries
Start Here Workflow 2

Write Queries and Learn to Use CQL

I know query basics - show me CQL

You understand query concepts and are ready to learn CQL specifics. Jump into functions, aggregations, visualizations, and practical query examples for real-world use cases.

  • CQL Functions & Operators
  • Aggregations & Grouping
  • Advanced Query Techniques
  • Visualization & Dashboards
Get Started Workflow 3

Automation, integration, and optimization

Power User & Builder

You are comfortable with analysis; now you want automation, integration, and optimization. Master advanced query functions, build custom parsers, integrate LogScale with external systems, and automate workflows.

  • Advanced Query Functions
  • Custom Parser Development
  • API Integration & Automation
  • Package Management & Publishing
Start Building Workflow 4

Monitor Applications and Infrastructure

DevOps Engineers

Learn CQL for application performance monitoring, error tracking, and infrastructure health. Covers queries for troubleshooting, deployment monitoring, and platform reliability.

  • Application Performance Monitoring
  • Error Tracking & Debugging
  • Infrastructure Health Checks
  • Deployment & Pipeline Monitoring
Start Learning Workflow 5

Reliability and Performance Analysis

Site Reliability Engineers (SRE)

Learn CQL for reliability engineering, performance monitoring, and capacity planning. Covers queries for SLI tracking, incident response, and system health analysis.

  • Performance & Latency Analysis
  • Reliability Metrics & Trends
  • Capacity Planning Queries
  • Incident Detection & Response
Start Learning Workflow 6

Monitor Infrastructure and System Administration

IT Operations (ITOps)

Learn CQL for infrastructure monitoring, resource tracking, and operational tasks. Covers queries for system health, capacity monitoring, and service availability.

  • Resource Usage Monitoring
  • System Health Checks
  • Service Availability Tracking
  • Capacity & Performance Analysis
Start Learning Workflow 7

Business Insights from Log Data

Data Analysts

Learn CQL for business analytics, user behavior analysis, and data-driven decision making. Covers queries for product metrics, user journeys, conversion tracking, and business KPIs.

  • User Behavior Analysis
  • Business Metrics & KPIs
  • Conversion Funnels & User Journeys
  • Product Analytics & Trends
Start Learning Workflow 8

Threat Hunting and Security Analysis

Security Operations (SecOps)

Learn CQL for security investigations, threat detection, and incident response. Covers queries for authentication analysis, anomaly detection, and security monitoring.

  • Threat Detection Queries
  • Authentication Analysis
  • Security Event Correlation
  • Incident Investigation
Start Learning

Workflow 1: New to Query Languages?

Learn the fundamentals of CQL step by step. Understanding these concepts makes writing queries intuitive and effective.

1

Getting Started with CQL

Understand what CQL is and how to access the query interface

What is CQL?

guideall usersbeginner

Introduction to CrowdStrike Query Language and its capabilities

CQL Quick Start

quickstartbeginner

Run your first query and understand the query interface
2

Core Query Concepts

Master the building blocks of every CQL query

Filtering Events

referenceintermediate

Search and filter events using field values and patterns

Search Syntax

referenceintermediate

Wildcards, regex, and search operators for precise filtering
3

Essential Functions

Learn the most commonly used CQL functions

table() - Display Results

referenceintermediate

Format query output in a readable table

top() - Find Top Values

referenceintermediate

Identify most common values for any field

timechart() - Plot Over Time

referenceintermediate

Visualize data trends across time buckets
4

Your First Queries

Practical examples to get you started

Query Examples by Use Case

guideintermediate

Copy and adapt real-world query examples for common scenarios: finding errors, tracking user activity, monitoring performance, and more.

Workflow 2: Ready to Write Queries?

Master CQL capabilities in this logical progression from functions to advanced techniques.

1

Functions & Operators

Master the complete CQL function library

Function Reference

referenceintermediate

Complete A-Z reference of all CQL functions

Data Manipulation

referenceintermediate

Transform, extract, and enrich fields

Operators

referenceintermediate

Comparison and logical operators

Calculations

referenceintermediate

Expressions, values, and calculations in CQL queries
2

Aggregations & Grouping

Summarize and group data for analysis

Aggregate Data

referenceintermediate

Count, sum, average, and statistical functions

groupBy()

referenceintermediate

Group results by field values for breakdowns

Time Buckets

referenceintermediate

Aggregate data into time windows
3

Parsing & Field Extraction

Extract structured data from raw text at query time

parseJson() - Parse JSON

guideintermediate

Extract fields from JSON strings in log data

kvParse() - Parse Key-Value Pairs

guideintermediate

Extract key-value pairs from unstructured text

regex() - Pattern Matching

referenceintermediate

Extract fields using regular expressions

Example: Extract URL Components

exampleintermediate

Parse URLs and extract page names with regex

Example: Extract Substrings

exampleintermediate

Extract alert types from security event strings
4

Advanced Query Techniques

Master complex query patterns

Joins & Lookups

guideadvanced

Combine data from multiple sources

Subqueries and ad-hoc tables

referenceadvanced

Create temporary tables for nested queries

Conditional Logic

referenceintermediate

case() and match() for branching logic

Sequence Detection Functions

referenceintermediate

Detect ordered sequences of events

correlate() Function

referenceintermediate

Match and combine related events

Array Functions

referenceintermediate

Work with arrays and multi-value fields
5

Visualization & Dashboards

Turn queries into visual insights.

Selection of widgets depends on the output and type of event set.

LogScale automatically disables incompatible widgets based on your query structure. Use the following guidelines for widget selection when converting table results:

  • Time-based data and numerical trends → Time Chart
  • Categorical data → Bar Chart / Pie Chart
  • Comparisons → Bar Chart
  • Distributions → Pie Chart
  • Relationships (for example IP address/Port combinations) → Sankey
  • Geographic/location data → World Map
  • Key metrics → Single Value / Gauge
  • Thresholds → Gauge.

Visualization Functions

guideintermediate

Charts, graphs, and visual representations

Dashboard Queries

guideintermediate

Create widgets and dashboard visualizations

Selecting Widgets Based on Query Output

guideintermediate

Choose the right widget type based on your query results and data structure

Visualizing the Same Query With Different Widgets

guideintermediate

Learn how to display query results using multiple widget types for different perspectives

Dashboard Design Best Practices and Templates

guideintermediate

Best practices and ready-to-use templates for security monitoring dashboards

Alert Queries

guideintermediate

Write queries for automated alerts
6

Best Practices & Optimization

Write efficient, maintainable queries

Query Best Practices

guideintermediate

Performance tips, optimization techniques, and common patterns

Troubleshooting Queries

troubleshootingintermediate

Debug slow queries, fix errors, and improve performance

Query Examples Library

guideintermediate

Browse the complete library of CQL query examples covering functions, aggregations, parsing, visualization, and advanced techniques. Copy and adjust the code for your own queries.

Workflow 3: Power User & Builder

Master advanced CQL techniques, build custom parsers, integrate LogScale with external systems, and automate workflows for power users and platform builders.

1

Query Functions (Deep Dive)

Master the less obvious ones: regex() , format() , eval() , parseJson() , parseXml() , parseCsv() , kvParse() , cidr() , array.*, objectArray.* functions.

Query Functions

guideintermediate

Complete reference for all CQL functions
2

Write a Parser

Build custom parsers with CQL to structure any log format at ingest time.

Writing Parsers

guideadvanced

Build custom parsers with CQL to structure any log format at ingest time
3

CrowdStrike Parsing Standard 1.2

The schema standard for normalized fields - critical if you are building packages or detections.

PASTA: CrowdStrike Parsing Standard

guideadvanced

The schema standard for normalized fields - critical if you are building packages or detections
4

Search API

Run CQL queries programmatically; integrate LogScale into external workflows.

Search API

apiintermediate

Run CQL queries programmatically; integrate LogScale into external workflows
5

Actions

Chain query results to webhooks, email, Slack, or other systems.

Actions

guideintermediate

Chain query results to webhooks, email, Slack, or other systems
6

Package Management & Marketplace

Build and publish reusable query packages (dashboards, saved searches, parsers).

Packages

guideadvanced

Build and publish reusable query packages (dashboards, saved searches, parsers)
7

LogScale Internal Architecture

Understanding how the engine works helps you write more performant queries (tag filtering, compaction, and so on).

LogScale Architecture

conceptadvanced

Understanding how the engine works helps you write more performant queries (tag filtering, compaction, and so on)
8

GraphQL API

Automate everything: repository management, user access, scheduled searches - all via API.

GraphQL API

apiadvanced

Automate everything: repository management, user access, scheduled searches - all via API

GraphQL Queries Reference

referenceadvanced

Browse all available GraphQL queries for retrieving configuration, user, and repository information.

GraphQL Mutations Reference

referenceadvanced

Browse all available GraphQL mutations for creating and managing repositories, users, dashboards, alerts, and more.

Workflow 4: DevOps Engineers

Learn CQL for application monitoring, error tracking, and infrastructure health with practical examples.

1

Parse & Extract Log Data

Extract structured data from application logs

Parsing Data

guideintermediate

Parse unstructured logs into structured fields

Field Selection

referenceintermediate

Select, transform, and create fields from log data

regex() Function

referenceintermediate

Extract fields using regular expressions

Example: Extract URL Components

exampleintermediate

Parse URLs and count page access patterns

Example: Deduplicate Logs

exampleintermediate

Remove duplicate log entries for cleaner analysis
2

Track Errors & Performance

Monitor application errors and response times

Aggregate Functions

referenceintermediate

Calculate error rates, averages, and percentiles

Query Filters

referenceintermediate

Filter events to isolate errors and specific conditions

percentage() Function

referenceintermediate

Calculate error rates as percentages

percentile() Function

referenceintermediate

Calculate latency percentiles (p50, p95, p99)

Example: HTTP Error Rates

exampleintermediate

Calculate client and server error percentages

Example: Response Time Analysis

exampleintermediate

Calculate response time percentiles for SLO monitoring

Example: Top Error URLs

exampleintermediate

Identify URLs with highest error counts
3

Monitor Infrastructure Health

Track platform health and resource utilization

groupBy() Function

referenceintermediate

Group metrics by host, service, or environment

Time Series Analysis

referenceintermediate

Visualize metrics over time for trend analysis

count() Function

referenceintermediate

Count events for volume and capacity tracking

Example: Hourly Event Patterns

exampleintermediate

Track event volume by hour

Example: Parser Health

exampleintermediate

Monitor parser performance and alert on issues
4

Alerts & Automation

Set up automated alerts and scheduled queries for application monitoring

What are Triggers

guideintermediate

Understand trigger types: Scheduled Search, Aggregate Alert, Filter Alert

Automated Queries

guideintermediate

Create scheduled queries and alerts for errors and performance issues

Actions

guideintermediate

Configure actions for notifications and integrations
5

Example DevOps Dashboards

View real-world application and infrastructure dashboard examples. Select the links below to see full dashboard screenshots and details.

Docker Overview Dashboard

conceptintermediate

Monitor container performance and health

Falcon Devices Dashboard

guideintermediate

Track device inventory and health metrics

Query Examples Library

guideintermediate

Browse the complete library of CQL query examples covering functions, aggregations, parsing, visualization, and advanced techniques. Copy and adjust the code for your own queries.

Workflow 5: Site Reliability Engineers (SRE)

Learn CQL for reliability engineering, performance analysis, and capacity planning with practical examples.

1

Statistical Analysis

Calculate statistical metrics for reliability indicators

Aggregate Functions

referenceintermediate

Statistical functions for SLI calculations

groupBy() Function

referenceintermediate

Group metrics by service, region, and endpoint

percentile() Function

referenceintermediate

Calculate percentiles for latency and performance SLIs

avg() Function

referenceintermediate

Calculate average metrics for baseline comparisons

Example: Latency Percentiles

exampleintermediate

Calculate p50, p75, p99, p99.9 for latency analysis

Example: Multi-Field Percentiles

exampleintermediate

Track percentiles across multiple metrics
2

Trend Detection & Forecasting

Detect trends and predict capacity needs

Sequence Detection Functions

referenceintermediate

Analyze event sequences and detect patterns

bucket() Function

referenceintermediate

Group data by time intervals for trend analysis

slidingWindow() Function

referenceintermediate

Analyze data over sliding event windows

slidingTimeWindow() Function

referenceintermediate

Analyze data over sliding time windows

Example: Trend Detection

exampleintermediate

Detect trends using neighbor comparison
3

Service Health Monitoring

Monitor service reliability and availability

Time Chart Analysis

referenceintermediate

Track availability and error rates over time

Conditional Logic

referenceintermediate

Use case statements for health status determination

max() Function

referenceintermediate

Find maximum values for SLA breach detection

min() Function

referenceintermediate

Find minimum values for baseline performance

Example: SLA Monitoring

exampleintermediate

Find slowest response times for SLA tracking

Example: Response Time Ranges

exampleintermediate

Calculate min/max response times for SLO validation

Example: Bucket Analysis

exampleintermediate

Analyze metric distribution across ranges
4

Capacity Planning

Plan capacity and track resource growth

sum() Function

referenceintermediate

Calculate total resource consumption

Example: Resource Tracking

exampleintermediate

Track event size and storage utilization
5

Example SRE Dashboards

View real-world reliability and performance dashboard examples. Select the links below to see full dashboard screenshots and details.

Falcon Spotlight Dashboard

conceptintermediate

Monitor system vulnerabilities and reliability

Severity Details Dashboard

guideintermediate

Track severity levels and performance trends

Query Examples Library

guideintermediate

Browse the complete library of CQL query examples covering functions, aggregations, parsing, visualization, and advanced techniques. Copy and adjust the code for your own queries.

Workflow 6: IT Operations (ITOps)

Learn CQL for infrastructure monitoring, system administration, and operational tasks with practical examples.

1

Query System Data

Search and filter infrastructure logs and metrics

Searching Data

guideintermediate

Search fundamentals for infrastructure logs

Filter System Events

referenceintermediate

Filter by host, service, status, and resource type

Operators

referenceintermediate

Use comparison and logical operators for filtering

Example: Field Validation

exampleintermediate

Test field values for system inventory
2

Aggregate Resource Metrics

Sum, average, and count infrastructure resources

Aggregate Functions

referenceintermediate

Calculate totals, averages, and counts for resources

groupBy() Function

referenceintermediate

Group metrics by host, environment, or cluster

avg() Function

referenceintermediate

Calculate average resource utilization

sum() Function

referenceintermediate

Sum total resource consumption

count() Function

referenceintermediate

Count systems, events, and resources

Example: CPU Utilization

exampleintermediate

Calculate and format average CPU usage

Example: CPU Range Distribution

exampleintermediate

Group CPU usage into ranges for analysis

Example: Event Counts

exampleintermediate

Count events per repository for capacity tracking
3

Monitor System Health

Track system status and detect failures

Health Over Time

referenceintermediate

Track system health metrics in time series

top() Function

referenceintermediate

Identify top resource consumers or failing systems

Example: Detect Offline Nodes

exampleintermediate

Identify offline or unhealthy nodes

Example: Failed Requests

exampleintermediate

Track failed requests for system health

Example: Hourly Health Patterns

exampleintermediate

Monitor system health patterns over time
4

Capacity & Trend Analysis

Analyze capacity and identify growth trends

bucket() Function

referenceintermediate

Group capacity data by time intervals

percentile() Function

referenceintermediate

Calculate percentiles for capacity threshold planning

Example: CPU Trends

exampleintermediate

Visualize CPU trends with windowing

Example: Resource Allocation

exampleintermediate

Calculate percentiles for capacity planning
5

Example ITOps Dashboards

View real-world infrastructure monitoring dashboard examples. Select the links below to see full dashboard screenshots and details.

Device Overview Dashboard

conceptintermediate

Monitor device inventory, health, and status

Device Policies Dashboard

guideintermediate

Track policy compliance and configuration management

Query Examples Library

guideintermediate

Browse the complete library of CQL query examples covering functions, aggregations, parsing, visualization, and advanced techniques. Copy and adjust the code for your own queries.

Workflow 7: Data Analysts

Learn CQL for business analytics, user behavior analysis, and extracting insights from log data with practical examples.

1

Understanding Log Data for Business

Extract business-relevant data from application and user event logs

Searching Data

guideintermediate

Search fundamentals for finding user and business events

Filter Events

referenceintermediate

Filter by user ID, session, feature, or business event type

Field Extraction

referenceintermediate

Extract user attributes, event properties, and business metrics

top() Function

referenceintermediate

Identify top users, features, or products by activity

Example: Find Top Values

exampleintermediate

Find most common values across any dimension
2

Track User Behavior & Journeys

Analyze user sessions, paths, and interaction patterns

Sequence Detection Functions

referenceintermediate

Track user journey steps and event sequences

groupBy() Function

referenceintermediate

Group events by user, session, or customer segment

Joins & Lookups

guideintermediate

Enrich user events with customer or product data

match() Function

referenceintermediate

Match user behavior patterns and segment users

Example: Group and Sort Events

exampleintermediate

Group events by user and sort by timestamp

Example: Count Session Visitors

exampleintermediate

Count unique visitors per session

Example: Sort Visitors by Activity

exampleintermediate

Sort visitors by activity level or session count
3

Calculate Business Metrics & KPIs

Compute conversion rates, retention, and key business metrics

Aggregate Functions

referenceintermediate

Calculate counts, sums, averages for business metrics

percentage() Function

referenceintermediate

Calculate conversion rates and success rates

count() Function

referenceintermediate

Count users, sessions, conversions, or events

sum() Function

referenceintermediate

Sum revenue, transactions, or business values

Conditional Logic

referenceintermediate

Use case statements to categorize users or events

Example: Calculate Percentages

exampleintermediate

Calculate rates and percentages for business metrics
4

Trend Analysis & Time-Based Insights

Analyze trends over time, detect patterns, and identify growth opportunities

timechart() Function

referenceintermediate

Visualize business metrics over time

bucket() Function

referenceintermediate

Group data by time periods for trend analysis

slidingTimeWindow() Function

referenceintermediate

Calculate rolling averages and moving metrics

Visualization Functions

guideintermediate

Create charts and graphs for business reporting

worldMap() Function

referenceintermediate

Visualize data on geographic maps

sankey() Function

referenceintermediate

Create flow diagrams to visualize user journeys

Example: Count Events Over Time

exampleintermediate

Track event counts in time series

Example: Multi-Metric Trends

exampleintermediate

Track multiple business metrics over time

Example: Hourly Patterns

exampleintermediate

Identify usage patterns by time of day

Example: Geographic Analysis

exampleintermediate

Add geographic location data to analyze user distribution

Example: User Flow Visualization

exampleintermediate

Visualize user navigation flows with Sankey diagrams
5

Example Analytics Dashboards

View real-world analytics dashboard examples. Select the links below to see full dashboard screenshots and details.

User Activity Dashboard

guideintermediate

Track user activity patterns and behavior

Web Activity Dashboard

guideintermediate

Monitor web usage and access patterns

Query Examples Library

guideintermediate

Browse the complete library of CQL query examples covering functions, aggregations, parsing, visualization, and advanced techniques. Copy and adjust the code for your own queries.

Workflow 8: Security Operations (SecOps)

Learn CQL for security analysis, threat hunting, and incident response with practical examples.

1

Search & Filter Security Data

Learn to search and filter security logs efficiently

Searching Data

guideintermediate

Search fundamentals and query structure for security logs

Query Filters

referenceintermediate

Filter security events using field comparisons and wildcards

Regular Expressions

referenceintermediate

Use regex patterns to match security indicators and threats

cidr() Function

referenceintermediate

Filter events by IP address ranges and subnets

match() Function

referenceintermediate

Match events against threat patterns

Example: Filter by IP Range

exampleintermediate

Filter events using CIDR subnets for network analysis

Example: Categorize Events

exampleintermediate

Count and compare security event categories
2

Correlate Security Events

Link related security events to detect attack patterns

Event Correlation

referenceintermediate

Match and combine events to detect multi-stage attacks

Joins & Lookups

guideintermediate

Enrich security data with threat intelligence lookups

Sequence Detection Functions

referenceintermediate

Detect ordered sequences of security events

Example: Task Event Correlation

exampleintermediate

Correlate scheduled task registration and deletion

Example: AWS Login Correlation

exampleintermediate

Correlate AWS federation and console login events

Example: IOC Detection

exampleintermediate

Detect indicators of compromise with IP lookups
3

Analyze Security Trends

Track security events over time and identify anomalies

Aggregate Functions

referenceintermediate

Count, group, and summarize security events

groupBy() Function

referenceintermediate

Group events by attacker, target, or threat type

top() Function

referenceintermediate

Identify top attackers, targets, or threat indicators

Visualize Security Data

guideintermediate

Create charts and visualizations for security dashboards

Example: Authentication Timeline

exampleintermediate

Correlate authentication attempts with database errors
4

Alerts & Automation

Set up automated alerts and scheduled queries for security monitoring

What are Triggers

guideintermediate

Understand trigger types: Scheduled Search, Aggregate Alert, Filter Alert

Automated Queries

guideintermediate

Create scheduled queries and security alerts

Actions

guideintermediate

Configure actions for notifications and integrations

Example: Parser Alerts

exampleintermediate

Alert on parser failures and issues
5

Example Security Dashboards

View real-world security dashboard examples. Select the links below to see full dashboard screenshots and details.

SIEM Connector Detections Dashboard

guideintermediate

View detection patterns and security alerts

Intel Indicators Dashboard

conceptintermediate

Track threat intelligence and IOCs

Query Examples Library

guideintermediate

Browse the complete library of CQL query examples covering functions, aggregations, parsing, visualization, and advanced techniques. Copy and adjust the code for your own queries.