logscale-security-queries

CrowdStrike LogScale Security Query Development

Expert assistance for developing security detection queries and hunting rules in CrowdStrike LogScale (formerly Humio) using CQL syntax.

When to Use This Skill

Use this skill when you need to:

• Write or optimize LogScale/CQL security queries
• Build threat detection rules with risk categorization
• Fix CQL syntax errors (especially case statements)
• Create investigation playbooks and hunting queries
• Develop queries for AWS CloudTrail, Entra ID, or CrowdStrike EDR
• Generate actionable security outputs with user context and remediation steps
• Build behavioral rules using correlate() for multi-event detection
• Create attack chain detections that span multiple events over time

Quick Start

Basic Query Structure

// 1. Filter relevant events
#event_simpleName=<EventType>
| <field_filters>

// 2. Categorize risk
| case {
    <critical_condition> | _RiskLevel := "Critical" ;
    <high_condition> | _RiskLevel := "High" ;
    * | _RiskLevel := "Low" ;
}

// 3. Enrich with context
| match(file="entraidusers.csv", field=UserPrincipalName, include=[DisplayName])

// 4. Generate output
| table([_RiskLevel, DisplayName, <key_fields>])

Critical Case Statement Rules

// ALWAYS use test() for numeric comparisons
| case {
    test(FailedLogins > 5) | _Severity := "Critical" ;  // ✅ CORRECT
    FailedLogins > 5 | _Severity := "Critical" ;        // ❌ WRONG
}

// AND/OR ARE supported in case branches (contrary to earlier docs)
// ✅ WORKS in case statements:
| case {
    DetectionTier = "RAPID" AND UniqueIPs > 1 | RiskScore := 90;
    UniqueIPs > 1 AND UniqueDevices > 1 | AttackPattern := "Distributed";
    * | RiskScore := 50;
}

// Use composite keys when AND/OR is cleaner for string matching
| _Key := format("%s-%s", field=[Type, Location])
| case {
    _Key="Admin-External" | _Risk := "High" ;
    * | _Risk := "Low" ;
}

// ALWAYS include default branch
| case {
    Status="Active" | _Label := "Active" ;
    * | _Label := "Unknown" ;  // ✅ Required
}