crowdstrike/fltr-tutorial Dashboards
The Basics - 01 - Primer
Widget | Description | Type |
---|---|---|
Welcome to LogScale! | The LogScale query language is extremely powerful. It's largely based on open standards and the language of mathematics, and balances simplicity and functionality to help users quickly find what they need, fast. In this tutorial, we'll use Falcon telemetry data to learn LogScale. The content and concepts we will cover, however, can be adapted and reused with any dataset that LogScale happens to be ingesting, e.g. first-party, third-party, etc. We will start with the very basics and build on the queries as we go. Hints on using the tutorial: - You can navigate between the dashboards by clicking on the word *Dashboards* in the upper-left corner. It is the link text right below the Falcon icon. Clicking on this link will take you back to the overview page showing all of the tutorial chapters. - You can display the source for every dashboard chapter. Simply click on the *edit* pencil icon near the upper-right corner, then click *Show queries* in the middle near the top of the page. Click *Discard changes* in the upper-right when you're done. Additional resources are available as references: - Official documentation: documentation on the query language. - LogScale Query Primer: a comprehensive guide on using the LogScale query language. - LogScale Query Building Blocks: this is a list of common questions we've seen in the field. - LogScale Function Addendum: these are examples of using a few of the common functions within LogScale. - FLTR Hunting and Investigations: threat hunting guide for Falcon data. Onward! | Note |
The Basics - 03 - Field Names Simplified
Widget | Description | Type |
---|---|---|
Sample of Available Field Names | logscale
| Table |
Event Tags |
Falcon LogScale has the ability to apply tags to events. In doing
so, it allows LogScale to quickly and efficiently include or
exclude large collections of events as you search. The application
of tags to telemetry is all done for you transparently when
dealing with Falcon data. The reason we're mentioning it is: one
very important field, event_simpleName, is
tagged in LogScale. Because of this, when you specify an
event_simpleName value in your LogScale
syntax, you need to put a # (hash or pound)
in front of that field. That's it. We'll start the query like this
in LogScale:
logscale
logscale
| Note |
The Basics - 04 - Comments
Widget | Description | Type |
---|---|---|
Output |
Displays a table of events limited to the first 100 entries.
logscale
| Table |
Event Tags |
Falcon LogScale has the ability to apply tags to events. In doing
so, it allows LogScale to quickly and efficiently include or
exclude large collections of events as you search. The application
of tags to telemetry is all done for you transparently when
dealing with Falcon data. The reason we're mentioning it is: one
very important field, event_simpleName, is
tagged in LogScale. Because of this, when you specify an
event_simpleName value in your LogScale
syntax, you need to put a # (hash or pound)
in front of that field. That's it. We'll start the query like this
in LogScale:
logscale
logscale
| Note |
Query |
logscale
| Note |
The Basics - 05 - Timestamps
Widget | Description | Type |
---|---|---|
Output |
Displays a table of events limited to the first 100 entries.
logscale
| Table |
Event Tags |
Falcon LogScale has the ability to apply tags to events. In doing
so, it allows LogScale to quickly and efficiently include or
exclude large collections of events as you search. The application
of tags to telemetry is all done for you transparently when
dealing with Falcon data. The reason we're mentioning it is: one
very important field, event_simpleName, is
tagged in LogScale. Because of this, when you specify an
event_simpleName value in your LogScale
syntax, you need to put a # (hash or pound)
in front of that field. That's it. We'll start the query like this
in LogScale:
logscale
logscale
| Note |
Query |
logscale
| Note |
The Basics - 06 - Assignment
Widget | Description | Type |
---|---|---|
Output |
Displays a table of events limited to the first 100 entries.
logscale
| Table |
Query |
logscale
| Note |
Event Tags |
Falcon LogScale has the ability to apply tags to events. In doing
so, it allows LogScale to quickly and efficiently include or
exclude large collections of events as you search. The application
of tags to telemetry is all done for you transparently when
dealing with Falcon data. The reason we're mentioning it is: one
very important field, event_simpleName, is
tagged in LogScale. Because of this, when you specify an
event_simpleName value in your LogScale
syntax, you need to put a # (hash or pound)
in front of that field. That's it. We'll start the query like this
in LogScale:
logscale
logscale
| Note |
The Basics - 07 - Regular Expressions
Widget | Description | Type |
---|---|---|
Output |
Displays a table of events limited to the first 100 entries.
logscale
| Table |
Event Tags |
Falcon LogScale has the ability to apply tags to events. In doing
so, it allows LogScale to quickly and efficiently include or
exclude large collections of events as you search. The application
of tags to telemetry is all done for you transparently when
dealing with Falcon data. The reason we're mentioning it is: one
very important field, event_simpleName, is
tagged in LogScale. Because of this, when you specify an
event_simpleName value in your LogScale
syntax, you need to put a # (hash or pound)
in front of that field. That's it. We'll start the query like this
in LogScale:
logscale
logscale
| Note |
Query |
logscale
| Note |
The Basics - 08 - Case Statements
Widget | Description | Type |
---|---|---|
Output |
Displays a table of events limited to the first 100 entries.
logscale
| Table |
Event Tags |
Falcon LogScale has the ability to apply tags to events. In doing
so, it allows LogScale to quickly and efficiently include or
exclude large collections of events as you search. The application
of tags to telemetry is all done for you transparently when
dealing with Falcon data. The reason we're mentioning it is: one
very important field, event_simpleName, is
tagged in LogScale. Because of this, when you specify an
event_simpleName value in your LogScale
syntax, you need to put a # (hash or pound)
in front of that field. That's it. We'll start the query like this
in LogScale:
logscale
logscale
| Note |
Query |
logscale
| Note |
The Basics - 09 - Functions
Widget | Description | Type |
---|---|---|
Output |
Displays a table of events limited to the first 100 entries.
logscale
| Table |
Event Tags |
Falcon LogScale has the ability to apply tags to events. In doing
so, it allows LogScale to quickly and efficiently include or
exclude large collections of events as you search. The application
of tags to telemetry is all done for you transparently when
dealing with Falcon data. The reason we're mentioning it is: one
very important field, event_simpleName, is
tagged in LogScale. Because of this, when you specify an
event_simpleName value in your LogScale
syntax, you need to put a # (hash or pound)
in front of that field. That's it. We'll start the query like this
in LogScale:
logscale
logscale
| Note |
Query |
logscale
| Note |
The Basics - 10 - Formatting Query Output
Widget | Description | Type |
---|---|---|
Output |
Displays a table of events limited to the first 100 entries.
logscale
| Table |
Event Tags |
Falcon LogScale has the ability to apply tags to events. In doing
so, it allows LogScale to quickly and efficiently include or
exclude large collections of events as you search. The application
of tags to telemetry is all done for you transparently when
dealing with Falcon data. The reason we're mentioning it is: one
very important field, event_simpleName, is
tagged in LogScale. Because of this, when you specify an
event_simpleName value in your LogScale
syntax, you need to put a # (hash or pound)
in front of that field. That's it. We'll start the query like this
in LogScale:
logscale
logscale
| Note |
Query |
logscale
| Note |
Query Output Options | There are generally 3 different ways to format the output: - table(): documentation. The table() function has lots of options for output, e.g. fields, limits, how the output is sorted, etc. - select(): documentation. You can think of select() as a stripped-down version of table(). It doesn't have a lot of parameters, but is extremely efficient when used in a query. Keep in mind that select() will limit the UI output to the latest 200 events. This only applies on the UI output of the query, and does not have the same limit when used in the middle of a query or during an export. - Event List: documentation. Event List isn't a function like table() or select(). Instead, it's the default output if you *don't* use table() or select() in your query. It has a lot of UI options for formatting the output, all the way down to the column-level. These options must be configured in the UI and can't be formatted directly in the query. Saving the query will also save the Event List options that you have specified. | Note |
The Basics - 11 - groupBy
Widget | Description | Type |
---|---|---|
Format Query Output with groupBy #2 |
Note in the search above, I've added the Event Search syntax I
want to translate to my search and quickly commented it out. This
is optional, but makes the translation of queries you already have
a little easier.
logscale
logscale
logscale
logscale
logscale
| Note |
Output |
Displays a table of events limited to the first 100 entries.
logscale
| Table |
Event Tags |
Falcon LogScale has the ability to apply tags to events. In doing
so, it allows LogScale to quickly and efficiently include or
exclude large collections of events as you search. The application
of tags to telemetry is all done for you transparently when
dealing with Falcon data. The reason we're mentioning it is: one
very important field, event_simpleName, is
tagged in LogScale. Because of this, when you specify an
event_simpleName value in your LogScale
syntax, you need to put a # (hash or pound)
in front of that field. That's it. We'll start the query like this
in LogScale:
logscale
logscale
| Note |
Query |
logscale
| Note |
The Basics - 12 - Parameters
Widget | Description | Type |
---|---|---|
Output |
Displays a table of events limited to the first 100 entries.
logscale
| Table |
Event Tags |
Falcon LogScale has the ability to apply tags to events. In doing
so, it allows LogScale to quickly and efficiently include or
exclude large collections of events as you search. The application
of tags to telemetry is all done for you transparently when
dealing with Falcon data. The reason we're mentioning it is: one
very important field, event_simpleName, is
tagged in LogScale. Because of this, when you specify an
event_simpleName value in your LogScale
syntax, you need to put a # (hash or pound)
in front of that field. That's it. We'll start the query like this
in LogScale:
logscale
logscale
| Note |
Query |
logscale
| Note |
The Basics - 13 - Visualizations
Widget | Description | Type |
---|---|---|
Output #2 | logscale
| Sankey |
Using Widget Visualizations #2 |
LogScale will only allow you to select compatible widgets. The
desired visualization widget can also be specified in the query
itself. As an example:
logscale
| Note |
Output |
Displays a table of events limited to the first 100 entries.
logscale
| Table |
Event Tags |
Falcon LogScale has the ability to apply tags to events. In doing
so, it allows LogScale to quickly and efficiently include or
exclude large collections of events as you search. The application
of tags to telemetry is all done for you transparently when
dealing with Falcon data. The reason we're mentioning it is: one
very important field, event_simpleName, is
tagged in LogScale. Because of this, when you specify an
event_simpleName value in your LogScale
syntax, you need to put a # (hash or pound)
in front of that field. That's it. We'll start the query like this
in LogScale:
logscale
logscale
| Note |
The Basics - 14 - Widget Formatting
Widget | Description | Type |
---|---|---|
Output #2 |
Displays a list of external API events limits results to the first
100 entries.
logscale
| Pie Chart |
Customizing Visualizations Using the Format Pane #2 | By clicking the paintbrush in the middle left, we can change view, color, and series options for our chart. When you select a visualization, the format pane will automatically adjust to include all available options. Please pick better colors than I did. | Note |
Output |
Displays a table of events limited to the first 100 entries.
logscale
| Table |
Event Tags |
Falcon LogScale has the ability to apply tags to events. In doing
so, it allows LogScale to quickly and efficiently include or
exclude large collections of events as you search. The application
of tags to telemetry is all done for you transparently when
dealing with Falcon data. The reason we're mentioning it is: one
very important field, event_simpleName, is
tagged in LogScale. Because of this, when you specify an
event_simpleName value in your LogScale
syntax, you need to put a # (hash or pound)
in front of that field. That's it. We'll start the query like this
in LogScale:
logscale
logscale
| Note |
The Basics - 15 - Match
Widget | Description | Type |
---|---|---|
Output |
Displays a table of events limited to the first 100 entries.
logscale
| Table |
Event Tags |
Falcon LogScale has the ability to apply tags to events. In doing
so, it allows LogScale to quickly and efficiently include or
exclude large collections of events as you search. The application
of tags to telemetry is all done for you transparently when
dealing with Falcon data. The reason we're mentioning it is: one
very important field, event_simpleName, is
tagged in LogScale. Because of this, when you specify an
event_simpleName value in your LogScale
syntax, you need to put a # (hash or pound)
in front of that field. That's it. We'll start the query like this
in LogScale:
logscale
logscale
| Note |
Query |
logscale
| Note |
The Basics - 16 - Field Extraction
Widget | Description | Type |
---|---|---|
Using Regular Expression Field Extraction #2 |
By default, when using regular expression extractions, they are
strict. Meaning if the data being searched does not match, it will
be omitted. A quick example would be:
logscale
| Note |
Output #3 | logscale
| Table |
Output |
Displays a table of events limited to the first 100 entries.
logscale
| Table |
Using Regular Expression Field Extraction #3 |
We can also use non-strict field extractions like so:
logscale
| Note |
Output #2 | logscale
| Table |
Event Tags |
Falcon LogScale has the ability to apply tags to events. In doing
so, it allows LogScale to quickly and efficiently include or
exclude large collections of events as you search. The application
of tags to telemetry is all done for you transparently when
dealing with Falcon data. The reason we're mentioning it is: one
very important field, event_simpleName, is
tagged in LogScale. Because of this, when you specify an
event_simpleName value in your LogScale
syntax, you need to put a # (hash or pound)
in front of that field. That's it. We'll start the query like this
in LogScale:
logscale
logscale
| Note |
The Basics - 17 - Query Building 101
Widget | Description | Type |
---|---|---|
Output #2 | logscale
| Bar Chart |
Output |
Displays a table of events limited to the first 100 entries.
logscale
| Table |
Query Building 101 - Part 2 |
Note in the output above I've trimmed the command line string
using format to only include the first 50 characters to make
things more readable. That line is as follows:
logscale
| Note |
Event Tags |
Falcon LogScale has the ability to apply tags to events. In doing
so, it allows LogScale to quickly and efficiently include or
exclude large collections of events as you search. The application
of tags to telemetry is all done for you transparently when
dealing with Falcon data. The reason we're mentioning it is: one
very important field, event_simpleName, is
tagged in LogScale. Because of this, when you specify an
event_simpleName value in your LogScale
syntax, you need to put a # (hash or pound)
in front of that field. That's it. We'll start the query like this
in LogScale:
logscale
logscale
| Note |
The Basics - 18 - Hyperlinks
Widget | Description | Type |
---|---|---|
Output |
Displays a table of events limited to the first 100 entries.
logscale
| Table |
Event Tags |
Falcon LogScale has the ability to apply tags to events. In doing
so, it allows LogScale to quickly and efficiently include or
exclude large collections of events as you search. The application
of tags to telemetry is all done for you transparently when
dealing with Falcon data. The reason we're mentioning it is: one
very important field, event_simpleName, is
tagged in LogScale. Because of this, when you specify an
event_simpleName value in your LogScale
syntax, you need to put a # (hash or pound)
in front of that field. That's it. We'll start the query like this
in LogScale:
logscale
logscale
| Note |
Query |
logscale
| Note |
The Basics - 19 - Helpful Query Examples
Widget | Description | Type |
---|---|---|
Format a number to two decimal places |
Calculate the average password age, in days, of Admin and Standard
user accounts and then round those values to a whole number:
logscale
| Note |
Place longitude and latitude on a world map example |
Displays an example of latitude and longitude on a world map.
logscale
| World Map |
Set a default field value |
Set a default field value. Similar to
fillnull in Event Search. If the field
GrandParentBaseFilename is blank, set it to
the value "Unknown."
logscale
| Note |
Set a default field value example |
Displays an example of how to set a default field value.
logscale
| Table |
Omit RFC-1819 addresses from search result |
Omit internal IP addresses when keying in on remote IP addresses.
logscale
| Note |
Place longitude and latitude on a world map |
Using a built-in geoip database and the function worldmap to map
all SSH connections.
logscale
| Note |
Concatenate two fields into a new, single field |
Take the fields UID and
UserSid and make them a new field named
userIdentifier.
logscale
| Note |
Output |
Displays a table of events limited to the first 100 entries.
logscale
| Table |
Query field for multiple values within |
Query a single field for multiple values using the in function.
logscale
| Note |
Use test to do field evaluations |
Similar to where in Event Search, check one field value against
another. In this example, see if a username has completed more
than 25 logons in a given search window:
logscale
| Note |
Format a number to two decimal places example | logscale
| Table |
Convert decimal values to hexadecimal values |
logscale
| Note |
Query field for multiple values within example | logscale
| Table |
Use test to do field evaluations example |
Displays a list of user logins by username and limits to the first
100 entries.
logscale
| Table |
Omit RFC-1819 addresses from search result example |
An example of a query that omits RFC-1819 addresses from a given
search result.
logscale
| Table |
Create concatenated, formatted fields |
Create a process lineage one-liner that includes grandparent,
parent, and target processes using format:
logscale
| Note |
Convert decimal values to hexadecimal values example |
An example query that displays a table of values converted from
decimal to hexadecimal values and additional data such as
username, logon type, and timestamp.
logscale
| Table |
Use match to query a lookup table |
Note that the specified lookup table must exist under "Files." In
this instance, we'll check for common ports and create a new field
with their associated protocol.
logscale
| Note |
Concatenate two fields into a new, single field example | logscale
| Table |
Use match to query a lookup table example | logscale
| Table |
Create concatenated, formatted fields example | logscale
| Table |
Event Tags |
Falcon LogScale has the ability to apply tags to events. In doing
so, it allows LogScale to quickly and efficiently include or
exclude large collections of events as you search. The application
of tags to telemetry is all done for you transparently when
dealing with Falcon data. The reason we're mentioning it is: one
very important field, event_simpleName, is
tagged in LogScale. Because of this, when you specify an
event_simpleName value in your LogScale
syntax, you need to put a # (hash or pound)
in front of that field. That's it. We'll start the query like this
in LogScale:
logscale
logscale
| Note |