### LogScale Script Setup

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Misc/queryjobs-pagination/README.md

Sets up a Python virtual environment and installs the 'requests' library for direct LogScale API interaction. Requires setting LogScale token, base URL, and repository as environment variables.

```bash
# One-time setup
cd _LogScale/script
python3 -m venv .venv
source .venv/bin/activate
pip install requests

# Environment variables (required)
export LOGSCALE_TOKEN="your-api-token"
export LOGSCALE_BASE_URL="https://your-logscale-instance.com/"
export LOGSCALE_REPO="your-repo-name"
```

--------------------------------

### Start the Playground Environment

Source: https://github.com/crowdstrike/logscale-community-content/wiki/Event-Forwarding-Playground

Use docker-compose to start all the necessary containers for the Event Forwarding Playground.

```bash
docker-compose up
```

--------------------------------

### Install FLC Binaries

Source: https://github.com/crowdstrike/logscale-community-content/wiki/FLC-Basic-Setup-and-Configuration

Commands for installing the LogScale Collector binaries on different operating systems. Ensure you have the correct version downloaded.

```bash
// Ubuntu
sudo dpkg -i humio-log-collector_1.7.1_linux_amd64

```

```bash
// Redhat
sudo rpm -i humio-log-collector_1.7.1_linux_amd64

```

--------------------------------

### Install Kubernetes with Kurl

Source: https://github.com/crowdstrike/logscale-community-content/wiki/Build-a-Kubernetes-Cluster-and-LogScale-Deployment

This section covers installing Kubernetes using Kurl on the coordinator node and joining worker nodes. Ensure to run the appropriate commands on the correct nodes.

```bash
echo "export KUBECONFIG=~/.kube/config" >> ~/.bashrc
echo "export PATH=$PATH:/var/lib/kurl/helm" >> ~/.bashrc
source ~/.bashrc

# Run this on the COORDINATOR node.
# It can take a while to complete. 
curl https://kurl.sh/latest | sudo bash

# Run the final output from the above command on the WORKER nodes. 
# Example: curl -fsSL https://kurl.sh/version/v2023.11.20-0/latest/join.sh | sudo bash -s kuber...

# Run this on the COORDINATOR node.
# Type "y" to overwrite the file.
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
bash -l

# Check the nodes.
# Run on the COORDINATOR node.
kubectl get nodes
```

--------------------------------

### Install Cert Manager and Apply Configuration

Source: https://github.com/crowdstrike/logscale-community-content/wiki/Build-a-Kubernetes-Cluster-and-LogScale-Deployment

Installs cert-manager using Helm and applies the LogScale cluster configuration. Ensure TLS is enabled in the configuration file before applying.

```bash
kubectl create namespace cert-manager
helm repo add jetstack https://charts.jetstack.io
helm repo update
helm install cert-manager jetstack/cert-manager --namespace cert-manager --set installCRDs=true

kubectl -n logging apply -f logscale-00.yaml

kubectl -n logging describe HumioCluster

helm upgrade --install ingress-nginx ingress-nginx --repo https://kubernetes.github.io/ingress-nginx --namespace ingress-nginx --create-namespace
```

--------------------------------

### Install FLC Binaries

Source: https://github.com/crowdstrike/logscale-community-content/wiki/FLC-Basic-Setup-with-Fleet-Management

Commands for installing the LogScale Collector binaries on different Linux distributions. Ensure you use the correct package manager for your system.

```bash
sudo dpkg -i humio-log-collector_1.7.1_linux_amd64
```

```bash
sudo rpm -i humio-log-collector_1.7.1_linux_amd64
```

--------------------------------

### NG-SIEM Script Setup

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Misc/queryjobs-pagination/README.md

Installs the 'crowdstrike-falconpy' library within an existing virtual environment. Requires setting Falcon API credentials as environment variables or using flags. Optional environment variables for base URL, member CID, and CA bundle are supported.

```bash
# One-time setup (same venv)
pip install crowdstrike-falconpy

# Environment variables (required — or use -k/-s flags)
export FALCON_CLIENT_ID="your-client-id"
export FALCON_CLIENT_SECRET="your-client-secret"

# Optional environment variables
export FALCON_BASE_URL="https://api.us-2.crowdstrike.com"  # defaults to US-1
export FALCON_MEMBER_CID="child-cid"                       # for MSSP / flight control
export CA_BUNDLE="/path/to/ca-bundle.pem"                  # for corporate proxy
```

--------------------------------

### Generate and Install Falcon LogScale Collector (Linux/macOS)

Source: https://github.com/crowdstrike/logscale-community-content/wiki/FLC-Simple-Install-with-Fleet-Management-in-Next‐Gen-SIEM

Use this command to install the Falcon LogScale Collector on Linux or macOS systems. Ensure the user has sudo access and the system has curl and a bash shell. The system must also be able to access the Fleet Management API via TCP 443.

```bash
curl -O https://raw.githubusercontent.com/CrowdStrike/logscale-community-content/main/Config-Samples/Log-Shippers/Falcon-LogScale-Collector/NG-SIEM/install.sh && sudo bash install.sh -c "Basic Syslog Config" -t "Basic Syslog Token"
```

--------------------------------

### Install Humio Operator with Helm

Source: https://github.com/crowdstrike/logscale-community-content/wiki/Build-a-Kubernetes-Cluster-and-LogScale-Deployment

Configure Helm repository and install the Humio operator. Ensure the version specified matches the HUMIO_OPERATOR_VERSION used for CRDs.

```bash
helm repo add humio-operator https://humio.github.io/humio-operator
helm install humio-operator humio-operator/humio-operator --namespace logging --create-namespace --version=${HUMIO_OPERATOR_VERSION}
```

--------------------------------

### Generate and Install Falcon LogScale Collector (Windows)

Source: https://github.com/crowdstrike/logscale-community-content/wiki/FLC-Simple-Install-with-Fleet-Management-in-Next‐Gen-SIEM

Execute this command in an administrative PowerShell window to install the Falcon LogScale Collector on Windows systems. The system must be able to access the Fleet Management API via TCP 443.

```powershell
Invoke-WebRequest -Uri https://raw.githubusercontent.com/CrowdStrike/logscale-community-content/main/Config-Samples/Log-Shippers/Falcon-LogScale-Collector/NG-SIEM/install.ps1 -OutFile .
.
/install.ps1 -c "Basic Syslog Config" -t "Basic Syslog Token"
```

--------------------------------

### Query CPU, RAM, Disk, and Firmware Info

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2021-10-29 - Cool Query Friday - CPU, RAM, Disk, Firmware, TPM 2.0, and Windows 11.md

This query retrieves detailed system information including CPU, RAM, disk space, and firmware details. It uses selfJoinFilter to ensure all required events are present and then aggregates and formats the data. Use this to get a comprehensive hardware and firmware inventory for your endpoints.

```logql
// Get 4 events of interest  
event_platform=Win  
| in(field="#event_simpleName", values=["AgentOnline","ResourceUtilization","SystemCapacity","ZeroTrustHostAssessment"])
  
// Use selfJoinFilter() to include only systems where all 4 events are in search window  
| selfJoinFilter(field=[aid], where=[{#event_simpleName=AgentOnline}, {#event_simpleName=ResourceUtilization}, {#event_simpleName=SystemCapacity}, {#event_simpleName=ZeroTrustHostAssessment}])  
  
// Aggregate by Agent ID  
| groupBy([aid], function=([selectLast([BiosManufacturer, ChasisManufacturer, CpuProcessorName, MemoryTotal,assessments.firmware_is_uefi, TpmFirmwareVersion, AvailableDiskSpace, AverageCpuUsage, AverageUsedRam])]), limit=max)  
  
// Format fields as required  
| unit:convert(AverageUsedRam, from="M", to="G")  
| UEFI:=upper("assessments.firmware_is_uefi") | drop(["assessments.firmware_is_uefi"])
| unit:convert(MemoryTotal, to="G", binary=true)  
| default(value="-", field=[TpmFirmwareVersion,BiosManufacturer, ChasisManufacturer,CpuProcessorName, AverageCpuUsage, MemoryTotal, AverageUsedRam, AvailableDiskSpace], replaceEmpty=true)  
  
// Check to see if TPM Firmware version is reporting indicating TPM 2.0  
| case {
TpmFirmwareVersion="-" | TPM:="-";
* | TPM:="2.0";
}
| drop([TpmFirmwareVersion])  
  
// Merge data from AID Master  
| match(file="aid_master_main.csv", field=[aid], include=[Version, ComputerName])  
  
// Final aggregation to order fields  
| groupBy([aid, ComputerName, BiosManufacturer, ChasisManufacturer, Version, CpuProcessorName, AverageCpuUsage, MemoryTotal, AverageUsedRam, AvailableDiskSpace, UEFI, TPM], function=[], limit=max)
```

--------------------------------

### Invoke Saved Query with Parameters

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2023-09-20 - Cool Query Friday - Up-leveling Teams With Text-box Driven Queries.md

This example shows how to invoke a saved query named 'WrittenFileHunt' with specific parameters. This allows for dynamic filtering and targeted threat hunting based on criteria like ComputerName, MinSizeThreshold, and FileWritten.

```logscale
$WrittenFileHunt(ComputerName="SE-AMU-WIN10-BL", MinSizeThreshold="20", FileWritten="*.zip")

```

--------------------------------

### Describe Kubernetes Resources

Source: https://github.com/crowdstrike/logscale-community-content/wiki/Build-a-Kubernetes-Cluster-and-LogScale-Deployment

Commands to get detailed information about various Kubernetes resources like Kafka, Deployments, Services, HumioClusters, and Ingresses. Useful for debugging and understanding resource states.

```bash
kubectl -n logging describe Kafka
kubectl -n logging describe Deployment
kubectl -n logging describe Service
kubectl -n logging describe HumioCluster
kubectl -n logging describe Ingress
```

--------------------------------

### Count RFM Linux Systems by Day

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/CrowdStrike-Query-Language-Map/CrowdStrike-Query-Language/bucket.md

This example counts RFM Linux systems per day. It first filters events, then groups by aid and day to select the last RFMState and timestamp, categorizes RFMState, and finally buckets the results by day to count endpoints.

```logql
#event_simpleName=OsVersionInfo RFMState=*
| day := formatTime("%Y-%m-%d", field=@timestamp, locale=en_US, timezone=Z)
| groupBy([aid, day], function=(selectLast([RFMState, @timestamp])), limit=max)
| RFMState match {
	1 => RFMState := "RFM" ;
	0 => RFMState := "OK" ;
	}
| bucket(1day, field=[RFMState], function=(count(field=aid, as="endpointCount")))
| _bucket := formatTime("%Y-%m-%d", field=_bucket, locale=en_US, timezone=Z)
```

--------------------------------

### Query Remote Response Session Start Events

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/View Recent RTR Sessions.md

This query retrieves Remote Response Session Start events, renames the Agent ID field, formats the timestamp, and displays key information in a table. It also enriches the data by matching Agent IDs with a master lookup file.

```logql
// Get RTR Start events
#repo=detections #event_simpleName=Event_RemoteResponseSessionStartEvent

// Rename Agent ID value
| rename(field="AgentIdString", as="aid")

// Display results in table
| table([StartTimestamp, UserName, aid], limit=20000)

// Bring in data from AID Master lookup file
| aid=~match(file="aid_master_main.csv", column=[aid], strict=false)

// Convert timestamp to human-readable value
| formatTime(format="%F %T %Z", as=StartTimestamp, field=StartTimestamp)
```

--------------------------------

### Self-Join Filter Example

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/CrowdStrike-Query-Language-Map/CrowdStrike-Query-Language/selfJoinFilter.md

This example demonstrates how to use selfJoinFilter to join ProcessRollup2 and DnsRequest events. It filters events, extracts process IDs, and then groups the joined events to count distinct event types and collect related process information.

```logql
event_platform=Win #event_simpleName=/^(ProcessRollup2|DnsRequest)$/
| falconPID := TargetProcessId
| falconPID := ContextProcessId
| selfJoinFilter([aid, falconPID], where=[{#event_simpleName=ProcessRollup2}, {#event_simpleName=DnsRequest}], prefilter=true)
| groupBy([aid, falconPID], function=([count(#event_simpleName, distinct=true, as=eventCount), collect([ParentBaseFileName, ImageFileName, CommandLine])]))
| test(eventCount==2)
```

--------------------------------

### Create Time Shards Without Rounding for GroupBy

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Frequency Analysis via Program Clustering.md

This example demonstrates manually creating time shards of 15 minutes without rounding to leverage groupBy. It then converts the shard to a human-readable format.

```logscale
// Get file names of interest
#event_simpleName=ProcessRollup2 event_platform=Win
| in(field="FileName", values=[whoami.exe, arp.exe, cmd.exe, net.exe, net1.exe, ipconfig.exe, route.exe, netstat.exe, nslookup.exe, nltest.exe, systeminfo.exe, wmic.exe, tasklist.exe, tracert.exe, ping.exe, adfind.exe, nbtstat.exe, find.exe, ldifde.exe, netsh.exe, wbadmin.exe], ignoreCase=true)

// Create time shards of 15 minutes
| regex(field=@timestamp, "(?<time_shard>[\d]{7})")
| format("%s000000", field=time_shard, as=time_shard)

// Group by shard and other key fields to emulate bucket
| groupBy([time_shard, cid, aid, ComputerName,ParentBaseFileName,ParentProcessId], function=[count(FileName, distinct=true, as=fNameCount), collect([FileName, CommandLine])], limit=max)

// Set threshold for file name appearances
| test(fNameCount>=4)

// Convert shard to human-redable format; shards will be slightly different as rounding is not occuring
| formatTime(format="%F %T", as="time_shard", field=time_shard)
```

--------------------------------

### timeChart Function Example

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/CrowdStrike-Query-Language-Map/CrowdStrike-Query-Language/timeChart.md

Use the timeChart function to visualize the count of events by 'LogonType' over a 1-day span.

```LogScale Query Language
timeChart(LogonType, function=count(aid),span=1d)
```

--------------------------------

### Filter User Logon Events on macOS

Source: https://github.com/crowdstrike/logscale-community-content/wiki/LogScale-Query-Primer

Use field shortcuts to filter events. This example gathers all user logon events specifically for macOS.

```logql
#event_simpleName=UserLogon event_platform=Mac
```

--------------------------------

### Get Latest OsVersionInfo and Check Sensor Support Status

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check for Unsupported Sensors.md

This query retrieves the latest OS version information per agent, extracts the Falcon build number, joins it with sensor support data, and identifies sensors that are out of support. It requires the 'falcon/investigate/sensors_support_info.csv' lookup file.

```LogScale Query Language
// Get OsVersionInfo events
#event_simpleName=OsVersionInfo
// Get latest OsVersionInfo data per aid
| groupBy([aid], function=([selectFromMax(field="@timestamp", include=[event_platform, ComputerName, AgentVersion])]), limit=max)
// Extract Falcon build number from AgentVersion 
| AgentVersion=/\\d+\.\\d+\.\\d+\.\\./
// Bring in sensor support details from lookup file
| BUILD=~match(file="falcon/investigate/sensors_support_info.csv", column="BUILD", include=[SUPPORT_ENDS], strict=true)
// Aggregate support status by Falcon build
| groupBy([event_platform, BUILD, AgentVersion, SUPPORT_ENDS], function=([count(aid, as=TotalSystems)]))
// Parse timestamp into epoch
| parseTimestamp("M/d/yy",field=SUPPORT_ENDS, as=SUPPORT_ENDS_EPOCH, timezone="UTC")
// See what sensors are out of support
| test(SUPPORT_ENDS_EPOCH < now())
// Drop unnecessary fields
| drop(["@timezone", SUPPORT_ENDS_EPOCH, "SUPPORT_ENDS_EPOCH.nanos"])
```

--------------------------------

### Get SensorHeartbeat Events for Multiple Platforms

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Percentage of Sensors in RFM.md

This query retrieves SensorHeartbeat events from Windows, macOS, and Linux systems. It then groups the events by platform and the most recent timestamp for each unique aid, selecting the SensorStateBitMap. Finally, it aggregates counts for specific SensorStateBitMap values (RFM and OK) per platform, calculates total and percentage values, and formats the percentage.

```logql
// Get SensorHeartbeat events for Windows, macOS, and Linux
#event_simpleName=SensorHeartbeat event_platform=/(^(Win|Mac|Lin)$)/
// Get most recent event for each aid value and include event_platform
| groupBy([event_platform, aid], function=([selectFromMax(field="@timestamp", include=[SensorStateBitMap])]))
// Aggregate by event_platform and count by SensorStateBitMap
| groupBy(event_platform, function=([{SensorStateBitMap=2 | count(as=RFM) }, {SensorStateBitMap=0 | count(as=OK)}])) 
// Create total and percentage values
| Total:= RFM + OK | PercentRFM := (RFM / Total) * 100 
// Optional: set threshold for % of systems in RFM; uncomment if desired
// | PercentRFM > 5
// Format percentage value
| PercentRFM:= format(format="%,.2f%%", field=[PercentRFM])
// Order fields with table
| table([event_platform, Total, RFM, OK, PercentRFM])
```

--------------------------------

### Advanced LogScale Join with Field Extraction

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/CrowdStrike-Query-Language-Map/CrowdStrike-Query-Language/join.md

This example demonstrates a more complex join operation involving field extraction for 'FilePath' and 'FileName'. It then applies wildcard matching to 'FileName' and 'UserName' after the join.

```logscale
#event_simpleName=ProcessRollup2
| ImageFileName=/(?<FilePath>(\/|\\).+(\/|\\))(?<FileName>.+$)/
| FileName=~wildcard(?FileName, ignoreCase=true)
| select([aid, ComputerName, UserSid, UserName, FilePath, FileName, CommandLine])
| join({#event_simpleName=/^(UserIdentity|UserLogon)$/ | UserName!=/(\$|\^DWM-|LOCAL\sSERVICE|^UMFD-|^$)/}, field=UserSid, include=UserName, mode=left)
| UserName=~wildcard(?UserName, ignoreCase=true)
```

--------------------------------

### Optimizing CQL queries with specific tags

Source: https://github.com/crowdstrike/logscale-community-content/wiki/LogScale-Query-Primer

Using specific tags like #event_simpleName significantly reduces query work units compared to broader tags like #kind. This example demonstrates grouping by 'aid' and selecting the last 'ComputerName'.

```cql
#kind=Secondary
| SecondaryEventType=aidmaster
| groupBy(aid, function=selectLast(ComputerName), limit=max)
```

```cql
#event_simpleName=AgentOnline OR #event_simpleName=HostnameChanged
| groupBy(aid, function=selectLast(ComputerName), limit=max)
```

--------------------------------

### Using Match Statement for Data Transformation in LogScale

Source: https://github.com/crowdstrike/logscale-community-content/wiki/LogScale-Query-Primer

This example shows how to use the `match` function to conditionally transform a field. It offers performance advantages over `case` when the target field is known to exist.

```logql
#event_simpleName=UserLogon event_platform=Lin
| UserIsAdmin match {
    1 => UserIsAdmin := "True" ;
    0 => UserIsAdmin := "False" ;
  }
| select([@timestamp, UserName, UID, LogonType, UserIsAdmin])
```

--------------------------------

### Get Sensor Heartbeat Events

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Sensors without Heartbeat Event in 20 Minutes.md

This query retrieves all sensor heartbeat events. It serves as the starting point for monitoring agent connectivity.

```logscale
#event_simpleName=SensorHeartbeat
```

--------------------------------

### Calculate Time Difference using Assignment Operator

Source: https://github.com/crowdstrike/logscale-community-content/wiki/LogScale-Query-Primer

Use the assignment operator (:=) to create new fields by assigning the result of an expression. This example calculates the time difference between the current time and a process start time.

```logscale
| timeDelta := now() - (ProcessStartTime*1000)
```

--------------------------------

### Basic Bucket Function Usage

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/CrowdStrike-Query-Language-Map/CrowdStrike-Query-Language/bucket.md

Demonstrates the basic syntax of the bucket function for dividing time into 1-day intervals and counting events.

```logql
| bucket(1day, field=[RFMState], function=(count(field=aid, as="endpointCount")))
```

--------------------------------

### Comma-Delineated List Example

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Searching Comma Delineated List With User Input.md

Example of a comma-delineated list format, used for specifying multiple values without spaces.

```Text
NO-FALCON,FALCONIDPTERM02
```

--------------------------------

### Enable Metrics Server

Source: https://github.com/crowdstrike/logscale-community-content/wiki/Build-a-Kubernetes-Cluster-and-LogScale-Deployment

Downloads and applies the metrics-server components to enable cluster metrics. Requires modifying the components.yaml file to add an insecure TLS flag for kubelet communication.

```bash
wget https://github.com/kubernetes-sigs/metrics-server/releases/latest/download/components.yaml
vi components.yaml
# Add "- --kubelet-insecure-tls" under "- --metric-resolution=15s", minus the quotes. Save the file.
kubectl apply -f components.yaml
```

--------------------------------

### Identify Process Starting a Service

Source: https://github.com/crowdstrike/logscale-community-content/wiki/FLTR-Hunting-and-Investigations

Shows the process responsible for starting a service. This query joins 'ProcessRollup2' events with 'ServiceStarted' events using the relevant process IDs.

```logscale
#event_simpleName=ProcessRollup2
| join({#event_simpleName=ServiceStarted}, key=RpcClientProcessId, field=SourceProcessId, include=ServiceDisplayName)
| table([aid, ImageFileName, ServiceDisplayName], limit=1000)
```

--------------------------------

### List Services and Pods

Source: https://github.com/crowdstrike/logscale-community-content/wiki/Build-a-Kubernetes-Cluster-and-LogScale-Deployment

Lists all services running in a namespace and all pods within a namespace. These commands help in monitoring the status and network configuration of the deployment.

```bash
kubectl -n logging get service
kubectl -n logging get pods
```

--------------------------------

### Create shorthand process lineage

Source: https://github.com/crowdstrike/logscale-community-content/wiki/LogScale-Query-Building-Blocks

Formats process lineage information into a concise string using `format()`.

```logscale
| default(field=GrandParentBaseFileName, value="Unknown")
| format(format="%s > %s > %s", field=[GrandParentBaseFileName,  ParentBaseFileName, FileName], as="processLineage")
```

--------------------------------

### Create Live Table of Executables in System32/SysWOW64

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Look for files running outside Windows systems folders with name masquerading.md

Defines a live table named 'LOLBinLocation' that captures executable files found within the System32 and SysWOW64 directories. This table is populated with data from the last 7 days.

```LogScale Query Language
| defineTable(query={
    #event_simpleName=ProcessRollup2 event_platform=Win FilePath=/\\Windows\\(System32|SysWOW64)\\/ FileName=/\.exe$/
    | FilePath=/(\\Device\\HarddiskVolume\\d+)?(?<ExpectedFilePath>\\.+)/
    | groupBy([FileName, ExpectedFilePath], function=[])
    }, 
    include=[FileName, ExpectedFilePath], name="LOLBinLocation", start=7d)
    
```

--------------------------------

### HEC Connector API Key and URL Example

Source: https://github.com/crowdstrike/logscale-community-content/wiki/FLC-Basic-Setup-and-Configuration

Example values for API key and API URL obtained from the Next-Gen SIEM HEC connector configuration. These are used to authenticate and direct data to the SIEM.

```text
// Example values from the UI
API key: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
API URL: https://XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.ingest.YY-Z.crowdstrike.com/services/collector

```

--------------------------------

### Analyze Installed Browser Extensions

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Enumerate Browser Extensions.md

This query identifies installed browser extensions, groups them by various attributes, and sorts them by the total number of endpoints. It normalizes browser names for better readability.

```LogScale Query Language
#event_simpleName=InstalledBrowserExtension BrowserExtensionId!="no-extension-available"
| groupBy([event_platform, BrowserName, BrowserExtensionId, BrowserExtensionName], function=([count(aid, distinct=true, as=TotalEndpoints)]))
| format("[See Extension](https://chromewebstore.google.com/detail/%s)", field=[BrowserExtensionId], as="Chrome Store Link")
| sort(order=desc, TotalEndpoints, limit=1000)
| case{
    in(BrowserName, values=["1","9"]) | BrowserName:="Firefox";
    BrowserName="2" | BrowserName:="Safari"
    BrowserName="3" | BrowserName:="Chrome";
    BrowserName="4" | BrowserName:="Edge";
    *;
}

```

--------------------------------

### System Capacity and Resource Utilization Query

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/SystemCapacity & ResourceUtilization.md

This query aggregates system capacity and resource utilization data, focusing on CPU and memory. It formats the output for better readability and joins with a master file to include computer names. Use this query to gain insights into system performance and resource consumption.

```logql
#event_simpleName=/^(SystemCapacity|ResourceUtilization)$/

| groupBy(aid, function=([selectLast([CpuProcessorName, PhysicalCoreCount, LogicalCoreCount, AverageCpuUsage, MemoryTotal, MaxUsedRam, AverageUsedRam, MaxUsedRam, AvailableDiskSpace])]))
| CpuProcessorName=* AND AvailableDiskSpace=* 
| percent := "%"
| gb := "GB"
| MemoryTotal := (MemoryTotal/1074000000)
| MemoryTotal := format("%,.2f", field=MemoryTotal)
| MaxUsedRam := (MaxUsedRam/1024)
| MaxUsedRam := format("%,.2f", field=MaxUsedRam)
| AverageUsedRam := (AverageUsedRam/1024)
| AverageUsedRam := format("%,.2f", field=AverageUsedRam)
| AveragePercentUsedRam := (AverageUsedRam/MemoryTotal)*100
| AveragePercentUsedRam := format("%,.2f", field=AveragePercentUsedRam)
| concat([AveragePercentUsedRam, percent], as="AveragePercentUsedRam")
| concat([MaxUsedRam, gb], as="MaxUsedRam")
| concat([MemoryTotal, gb], as="MemoryTotal")
| concat([AverageUsedRam, gb], as="AverageUsedRam")
| concat([AverageCpuUsage, percent], as="AverageCpuUsage")
| concat([AvailableDiskSpace, gb], as="AvailableDiskSpace")
| drop([gb, percent])
| match(file="fdr_aidmaster.csv", field=aid, include=ComputerName, ignoreCase=true, strict=false)
| select([aid, ComputerName, CpuProcessorName, PhysicalCoreCount, LogicalCoreCount, AverageCpuUsage, MemoryTotal, MaxUsedRam, AverageUsedRam, AveragePercentUsedRam, MaxUsedRam, AvailableDiskSpace])

```

--------------------------------

### Filter UI Audit Events for 'get' Commands

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check for Falcon Analysts Running get Command.md

This query filters UI audit events to find actions where commands contain the string 'get'. It then aggregates results to show users, agent IDs, and collected commands.

```LogScale Query Language
// Get UI Audit Events
#repo="detections" ExternalApiType=/Remote/

// Check commands for "get"
| array:regex("Commands[]",regex="get")

// Create unified "Commands" field
| concatArray("Commands", separator="; ", as=Commands)

// Check to make sure Commands is populated
| Commands=*

// Aggregate results
| groupBy([UserName, AgentIdString], function=([collect([Commands])]))
| groupBy([UserName], function=([count(AgentIdString, as=SystemsAccssed), collect([Commands])]))
```

--------------------------------

### Extract and Evaluate Chrome Versions with Regex and Case

Source: https://github.com/crowdstrike/logscale-community-content/wiki/LogScale-Query-Primer

Use regex to parse application versions and a case statement to identify systems needing patches. Ensure 'InstalledApplication' events are ingested.

```logql
// Get InstalledApplication events for Google Chrome
#event_simpleName=InstalledApplication AppName="Google Chrome"
// Get latest AppVersion for each system
| groupBy(aid, function=([selectLast([AppVendor, AppName, AppVersion, InstallDate])]))
// Use regex to break AppVersion field into components
| AppVersion = /(?<majorVersion>\d+)\.(?<minorVersion>\d+)\.(?<buildNumber>\d+)\.(?<subBuildNumber>\d+)$/i
// Evaluate builds that need to be patched
| case {
    majorVersion>=110 | needsPatch := "No" ;
    majorVersion>=109 AND buildNumber >= 5414 | needsPatch := "No" ;
    majorVersion<=109 AND buildNumber < 5414 | needsPatch := "Yes" ;
    majorVersion<=108 | needsPatch := "Yes" ;
    * 
  }
// Check for needed update  and Organize Output
| needsPatch = "Yes"
| select([aid, InstallDate, needsPatch, AppVendor, AppName, AppVersion, InstallDate])
// Convert timestamp
| InstallDate := InstallDate *1000
| InstallDate := formatTime("%Y-%m-%d", field=InstallDate, locale=en_US, timezone=Z)

```

--------------------------------

### Describe HumioCluster Resource

Source: https://github.com/crowdstrike/logscale-community-content/wiki/Build-a-Kubernetes-Cluster-and-LogScale-Deployment

Get detailed information about the HumioCluster resource, which can help in troubleshooting any deployment issues.

```bash
kubectl -n logging describe HumioCluster
```

--------------------------------

### Apply NodePort Service and Verify

Source: https://github.com/crowdstrike/logscale-community-content/wiki/Build-a-Kubernetes-Cluster-and-LogScale-Deployment

Applies the NodePort service definition and verifies that the service is running and accessible. The comment indicates how to connect via HTTPS using the DNS name and node port.

```bash
kubectl -n ingress-nginx apply -f ingress-nodeport.yaml

kubectl -n ingress-nginx get services
```

--------------------------------

### Filter Windows Process Events

Source: https://github.com/crowdstrike/logscale-community-content/wiki/LogScale-Query-Primer

Start by filtering for all Windows process execution events. This is a foundational step for narrowing down the dataset.

```logscale
#event_simpleName=ProcessRollup2 event_platform=Win
```

--------------------------------

### Create Process Lineage Tree

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Hunting EDR Freeze.md

This query constructs a process lineage tree for easier analysis, displaying the grandparent, parent, and current process information including their command lines.

```logscale
// Create process lineage tree for easier reading
| ProcessLineage:=format(format="%s (%s)\n\t└ %s (%s)\n\t\t└ %s (%s)", field=[GrandparentImageFileName, GrandparentCommandLine, ParentImageFileName, ParentCommandLine, ImageFileName, CommandLine])
```

--------------------------------

### Show ScheduledTaskRegistered Events Triggered at Startup

Source: https://github.com/crowdstrike/logscale-community-content/wiki/FLTR-Hunting-and-Investigations

This query identifies scheduled tasks set to execute upon system startup. It parses the TaskXml to find and display boot triggers.

```logql
#event_simpleName=ScheduledTaskRegistered
| parseXml(TaskXml)
| Trigger:=rename(Task.Triggers.BootTrigger.Enabled)
| Trigger=* 
| table([aid, Trigger, TaskXml], limit=1000)
```

--------------------------------

### Remove Characters with Regex

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/CrowdStrike-Query-Language-Map/CrowdStrike-Query-Language/replace.md

Removes characters from an IP address field that match a given regular expression. This example removes all characters.

```logscale
| ip =~replace(".", with="")
```

--------------------------------

### Parse Linux OS Version Info (New Way)

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Linux Sensors in Kernel Mode, User Mode, and RFM.md

This query processes `OsVersionInfo` events on Linux to extract detailed OS version information, including the kernel and distribution name. It uses `case` for backend mapping, `groupBy` to select the last event per agent, and `regex` to parse the pretty name.

```LogScale Query Language
#event_simpleName=OsVersionInfo event_platform=Lin

| LinuxSensorBackend=* 
| case{

    LinuxSensorBackend=0 | LinuxSensorBackend := "Kernel";
    LinuxSensorBackend=1 | LinuxSensorBackend := "eBPF";
    *;
}

| groupBy([aid], function=(selectLast([AgentVersion, LinuxSensorBackend, OSVersionFileData])))
| replace("([0-9A-Fa-f]{2})", with="%$1", field=OSVersionFileData, as=OSVersionFileData)
| OSVersionFileData:=urlDecode("OSVersionFileData")
| regex("PRETTY_NAME=\"(?<DistroName>[^\"]+)\"", field=OSVersionFileData, strict=false)
| select([aid, AgentVersion, LinuxSensorBackend, DistroName, OSVersionFileData])

```

--------------------------------

### List LogScale Pods

Source: https://github.com/crowdstrike/logscale-community-content/wiki/Build-a-Kubernetes-Cluster-and-LogScale-Deployment

Get a list of all pods belonging to the LogScale deployment. This helps in identifying individual pod names for further inspection.

```bash
kubectl -n logging get pods | grep logscale
```

--------------------------------

### Select and Order Output Fields

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Falcon Authentication from Unexpected GeoHash.md

This snippet shows how to select and order the final output fields, including UserId, logon times, logon count, time delta, map link, and IP details. This helps in presenting the analyzed data in a clear and organized manner.

```logscale
| select([UserId, firstLogon, lastLogon, logonCount, timeDelta, Map, ipDetails])
```

--------------------------------

### Get GeoIP Data

Source: https://github.com/crowdstrike/logscale-community-content/wiki/LogScale-Query-Building-Blocks

Retrieves GeoIP data for a given IP address stored in the `aip` field using the `ipLocation` function.

```cql
| ipLocation(field=aip)
```

--------------------------------

### Get String Length with length()

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/CrowdStrike-Query-Language-Map/CrowdStrike-Query-Language/length.md

Use the `length` function to determine the number of characters in a string field. The result can be aliased using `as` for clarity.

```logql
| length("CommandLine", as="cmdLength")
```

--------------------------------

### Aggregate Process Executions in 10-Minute Buckets

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Frequency Analysis via Program Clustering.md

Use this query to aggregate process executions in 10-minute buckets, searching over a 24-hour period. It counts distinct file names and collects associated command lines.

```logscale
// Get file names of interest
event_platform=Win #event_simpleName=ProcessRollup2 FileName=/(whoami|arp|cmd|net|net1|ipconfig|route|netstat|nslookup|nltest|systeminfo|wmic|tasklist|tracert|ping|adfind|nbtstat|find|ldifde|netsh|wbadmin)\\.exe/i

// Aggregate in 10 minute buckets; set search to 24 hours
| bucket(span=10min, field=[cid, aid, ComputerName,ParentBaseFileName,ParentProcessId], function=[count(FileName, distinct=true, as=fNameCount), collect([FileName, CommandLine])], limit=500)

// Set threshold at three distinct file name values
| test(fNameCount>=3)
```

--------------------------------

### Create a process tree using format() function

Source: https://github.com/crowdstrike/logscale-community-content/wiki/LogScale-Query-Building-Blocks

Formats process information to display a hierarchical tree structure. It extracts file path and name, then formats the parent, child, and process ID.

```logscale
#event_simpleName = ProcessRollup2 event_platform = Win ParentBaseFileName = "explorer.exe"
| ImageFileName = /(\\Device\\HarddiskVolume\d+)?(?<FilePath>\\.+\\)(?<FileName>.+$)/
| ExecutionChain := format(format="%s\n\t└ %s (%s)", field=[ParentBaseFileName, FileName, RawProcessId])
| select(ExecutionChain)
```

--------------------------------

### Process Analysis with Wildcard Parameters and Join

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Merge Parent_Child PR2 with Join.md

This query extends process analysis using wildcard parameters for flexible matching of process names and file names. It incorporates a join operation with a limit to capture detailed child process information, including user data.

```logscale
#event_simpleName=ProcessRollup2
| aid=?{aid=*} 
| ImageFileName =~ wildcard(?{ImageFileName="*"}, ignoreCase=true, includeEverythingOnAsterisk=true)
| ImageFileName=/(\/|\\)(?<FileName>\w*\.?\w*)$/
| join({
    #event_simpleName=ProcessRollup2
    | aid=?{aid=*} 
    | ParentBaseFileName =~ wildcard(?{ParentBaseFileName="*"}, ignoreCase=true)
    | ImageFileName =~ wildcard(?{ImageFileName="*"}, ignoreCase=true)
    | MD5 := MD5HashData
    | ImageFileName=/(\/|\\)(?<ChildFileName>\w*\.?\w*)$/
    | ChildCLI := CommandLine
    | ChildUser := UserName
  }, key=ParentProcessId, field=TargetProcessId, include=[MD5, ChildFileName, ChildCLI, ChildUser], limit=200000)
| groupBy([aid, ComputerName, UserName, ChildUser, FileName, CommandLine, ChildFileName, ChildCLI, MD5], limit=max)
```

--------------------------------

### Set LogScale Operator Version

Source: https://github.com/crowdstrike/logscale-community-content/wiki/Build-a-Kubernetes-Cluster-and-LogScale-Deployment

Export the desired LogScale operator version to the HUMIO_OPERATOR_VERSION environment variable. This is typically done before installing the LogScale operator.

```bash
# Check the site for the latest version.
export HUMIO_OPERATOR_VERSION=0.20.1
```

--------------------------------

### Enroll FLC Instance

Source: https://github.com/crowdstrike/logscale-community-content/wiki/FLC-Basic-Setup-with-Fleet-Management

Commands to enroll the installed LogScale Collector with Fleet Management. Run the command specific to your operating system from an elevated prompt.

```powershell
// Windows
// Run this from PowerShell or cmd.exe as administrator. 
"C:\Program Files (x86)\CrowdStrike\Humio Log Collector\humio-log-collector.exe" enroll XXXXXXXXXXXXXXXX
```

```bash
// Linux
sudo humio-log-collector enroll XXXXXXXXXXXXXXXX
```

```bash
// MacOS
sudo logscale-collector enroll XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
```

--------------------------------

### Output Details to Table

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Hunting EDR Freeze.md

Outputs the relevant details including timestamp, aid, computer name, context process ID, and the created process lineage to a table for review.

```logscale
// Output deatils to table
| table([@timestamp, aid, ComputerName, ContextProcessId, ProcessLineage])
```

--------------------------------

### Get Pod Logs

Source: https://github.com/crowdstrike/logscale-community-content/wiki/Build-a-Kubernetes-Cluster-and-LogScale-Deployment

Retrieves logs from a specific pod, including application-specific logs if a container name is provided. This is essential for diagnosing runtime issues.

```bash
kubectl -n logging logs logscale-00-core-tbqxdh
kubectl -n logging logs logscale-00-core-tbqxdh -c humio
```

--------------------------------

### Correlate Command Executions

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/CrowdStrike-Query-Language-Map/CrowdStrike-Query-Language/correlate.md

Correlates the execution of 'whoami', 'net', and 'systeminfo' commands on the same system within a 5-minute interval, where the order of execution does not matter.

```logql
correlate(
    // Search for whoami executions on Windows
    whoami: {
         #event_simpleName=ProcessRollup2 event_platform=Win FileName="whoami.exe" 
    } include: [aid, ComputerName, FileName],
    // Search for net executions on Windows
    net: {
         #event_simpleName=ProcessRollup2 event_platform=Win FileName=/^net1?\.exe$/
          | aid <=> whoami.aid
          } include: [aid, ComputerName, FileName],
    // Search for systeminfo executions on Windows
    systeminfo: {
         #event_simpleName=ProcessRollup2 event_platform=Win FileName="systeminfo.exe"
          | aid <=> net.aid
          } include: [aid, ComputerName, FileName],
sequence=false, within=5m)

```

--------------------------------

### Get Successful Falcon Console Logins

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Cool-Query-Friday/2023-06-14 - Cool Query Friday - Watching the Watchers - Profiling Falcon Console Logins via Geohashing.md

Filters for successful user authentication events from the Falcon console. Useful for monitoring administrative access.

```LogScale Query Language
EventType=Event_ExternalApiEvent OperationName=userAuthenticate Success=true
```

--------------------------------

### Detect Web Servers or Database Processes Running as Local System

Source: https://github.com/crowdstrike/logscale-community-content/wiki/FLTR-Hunting-and-Investigations

This query identifies web server (w3wp, httpd, nginx) or database (sqlservr) processes running under a Local System account. It groups results by the ImageFileName and collects associated data.

```logscale
#event_simpleName=ProcessRollup2
| ImageFileName=/(w3wp|sqlservr|httpd|nginx)\.exe/i
| groupBy(aid, function=collect([ImageFileName, CommandLine]), limit=max)

```

--------------------------------

### Inline Field Extraction with Regex

Source: https://github.com/crowdstrike/logscale-community-content/wiki/LogScale-Query-Primer

Combine regular expressions with inline field extraction to capture specific data. This example extracts the system folder name from ImageFileName.

```logql
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\(?<systemFolder>(System32|SysWow64))\\/i
| groupBy([systemFolder, ImageFileName])
```

--------------------------------

### Kubernetes Ingress Definition

Source: https://github.com/crowdstrike/logscale-community-content/wiki/Build-a-Kubernetes-Cluster-and-LogScale-Deployment

Defines an Ingress resource for LogScale, specifying TLS settings and backend service configuration. Ensure the host and secret name match your setup.

```yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: logscale-00-ingress
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
    nginx.ingress.kubernetes.io/proxy-ssl-name: "logscale-00.logging"
    nginx.ingress.kubernetes.io/proxy-ssl-server-name: "logscale-00.logging"
    nginx.ingress.kubernetes.io/proxy-ssl-secret: "logging/logscale-00"
spec:
  ingressClassName: nginx
  tls:
  - hosts:
      - logscale.logscale-00.com
    secretName: cert-logscale-00
  rules:
  - host: logscale.logscale-00.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: logscale-00
            port:
              number: 8080
```

--------------------------------

### Update and Upgrade OS

Source: https://github.com/crowdstrike/logscale-community-content/wiki/Build-a-Kubernetes-Cluster-and-LogScale-Deployment

Run these commands on each node to update the operating system and upgrade packages. A reboot is required after the upgrade.

```bash
sudo apt update && sudo apt upgrade
sudo reboot
```

--------------------------------

### Find Repository by Top Criteria

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Get Repository Ingestion in Raptor.md

Use this query to find repositories based on top criteria like repository name, vendor, or type. Ensure you have the necessary context for the fields used.

```logql
| top([#repo, #Vendor, #type])
```

--------------------------------

### Restart FLC Service

Source: https://github.com/crowdstrike/logscale-community-content/wiki/FLC-Basic-Setup-and-Configuration

Commands to restart the Humio Log Collector service on Windows and Linux to apply the new configuration. Enabling the service on Linux ensures it starts on boot.

```bash
// Windows
Open services.msc and restart "Humio Log Collector"

```

```bash
// Linux
sudo systemctl restart humio-log-collector.service
sudo systemctl enable humio-log-collector.service

```

--------------------------------

### Parse Linux OS Version with Host and Kernel Info

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/OsVersionInfo OsVersionFileData Decode.md

Extracts host name, kernel version, agent version, and OS version file data from Linux logs. Uses regex to capture specific patterns.

```logql
#event_simpleName=OsVersionInfo event_platform=Lin

| OSVersionString = /^Linux\s(?<hostName>\S+)\s(?<kernelVersion>\S+)\s/i
| OSVersionFileData=*
| replace("([0-9A-Fa-f]{2})", with="%$1", field=OSVersionFileData, as=OSVersionFileData)
| OSVersionFileData:=urlDecode("OSVersionFileData")
| regex("PRETTY_NAME=\"(?<DistroName>[^\"]+)\"", field=OSVersionFileData, strict=false)
| groupBy(aid, function=([selectLast([hostName, kernelVersion, AgentVersion, OSVersionFileData])]))

```

--------------------------------

### HEC Connector API Credentials

Source: https://github.com/crowdstrike/logscale-community-content/wiki/FLC-Basic-Setup-with-Fleet-Management

Example values for API key and API URL obtained from the Next-Gen SIEM HEC/HTTP Event Collector configuration. These are required for configuring the FLC.

```text
API key: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
API URL: https://XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.ingest.YY-Z.crowdstrike.com/services/collector
```

--------------------------------

### FalconPy NGSIEM Usage for QueryJobs

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Misc/queryjobs-pagination/README.md

Example Python code demonstrating how to use the FalconPy library to interact with NGSIEM Search APIs. This includes creating, polling, and stopping a search job.

```python
from falconpy import NGSIEM

with NGSIEM(client_id="...", client_secret="...") as ngsiem:
    if ngsiem.token_fail_reason:
        raise SystemExit(f"Auth failed: {ngsiem.token_fail_reason}")

    # Create
    resp = ngsiem.start_search(repository="search-all", query_string="...", start="1h", end="now")
    job_id = resp["resources"]["id"]

    # Poll (response is in resp["body"], not resp["resources"])
    resp = ngsiem.get_search_status(repository="search-all", id=job_id)
    data = resp.get("resources") or resp.get("body", {})
    events = data["events"]
    done = data["done"]

    # Cleanup
    ngsiem.stop_search(repository="search-all", id=job_id)
```

--------------------------------

### Generate and Parse Events with createEvents() and kvParse()

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/CrowdStrike-Query-Language-Map/CrowdStrike-Query-Language/createEvents.md

Combine createEvents() with kvParse() to generate temporary events and then parse them into fields. This is useful when raw strings are in a key-value pair format.

```logql
createEvents(["Shape=Square, Color=Red", "Shape=Circle, Color=Blue", "Shape=Triangle, Color=Green"])
| kvParse()
```

--------------------------------

### Invoke Saved Query as a Function

Source: https://github.com/crowdstrike/logscale-community-content/wiki/LogScale-Query-Primer

Leverage saved queries as functions within new queries. This example invokes a saved query named 'ConvertUserIsAdmin' to process user logon events.

```logql
#event_simpleName=UserLogon
| $UserIsAdmin()
| select([aid, UserName, UserSid, UserIsAdmin, UserIsAdmin_Readable])
```

--------------------------------

### Non-Destructive Case Statement for New Field Creation

Source: https://github.com/crowdstrike/logscale-community-content/wiki/LogScale-Query-Primer

Utilize a non-destructive case statement to create a new field with conditional values. This example maps 'UserIsAdmin' to a new 'UserIsAdmin_Readable' field.

```logql
| case {
    UserIsAdmin=1 | UserIsAdmin_Readable := "True" ;
    UserIsAdmin=0 | UserIsAdmin_Readable := "False" ;
    * ; 
  }
```

--------------------------------

### Destructive Case Statement for Field Substitution

Source: https://github.com/crowdstrike/logscale-community-content/wiki/LogScale-Query-Primer

Use a destructive case statement to overwrite an existing field's value based on conditions. This example converts 'UserIsAdmin' from 1/0 to 'True'/'False'.

```logql
| case {
    UserIsAdmin=1 | UserIsAdmin := "True" ;
    UserIsAdmin := "False" ;
    * ; 
  }
```

--------------------------------

### Detect Linux/macOS System Information Discovery

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/MITRE-ATT&CK-Enterprise/(TA007) Discovery/(T1082) System Information Discovery.md

Use this query to detect the execution of common Linux and macOS utilities for system information discovery, including systeminfo, systemsetup, df, uname, system_profiler, lsmod, csrutil, kmod, and hostname.

```LogScale
#event_simpleName=ProcessRollup2 event_platform=/^(Lin|Mac)$/ ImageFileName=/\/(systeminfo|systemsetup|df|uname|system_profiler|lsmod|csrutil|kmod|hostname)/
```

--------------------------------

### Navigate to Event Forwarding Playground Directory

Source: https://github.com/crowdstrike/logscale-community-content/wiki/Event-Forwarding-Playground

Change your current directory to the Event Forwarding Playground folder within the cloned repository.

```bash
cd logscale-community-content/Config-Samples/EventForwarding-Playground
```

--------------------------------

### Join Firewall and Process Data

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Firewall Rule Additions.md

Joins firewall rule data with process information based on the target process ID. Requires the FirewallRule and FirewallRuleId fields to be present.

```logql
#event_simpleName=ProcessRollup2

| join({#event_simpleName=FirewallSetRule}, key=ContextProcessId, field=TargetProcessId, include=[FirewallRule, FirewallRuleId])
| ImageFileName=/.*\\(?<fileName>.*\\..*)/
| table([aid, UserSid, fileName, FirewallRuleId, FirewallRule, ImageFileName, CommandLine])

```

--------------------------------

### Get Last Event for Each Agent ID

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Sensors without Heartbeat Event in 20 Minutes.md

This query groups events by Agent ID and selects the timestamp of the last event for each agent. Use this to find the most recent heartbeat for every agent.

```logscale
| groupBy([aid], function=([selectLast([@timestamp])]))
```

--------------------------------

### Match Statement Syntax in LogScale

Source: https://github.com/crowdstrike/logscale-community-content/wiki/LogScale-Query-Primer

Illustrates the general syntax for using the `match` function to substitute values in a target field based on specific conditions.

```logql
| targetField match {
    value1 => targetField := "substitution1" ;
    value2 => targetField := "substitution2" ;
  }
```

--------------------------------

### Ensure Uninstall Event Exists

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Check for Falcon AcUninstallConfirmation Event Followed by no Heartbeat Events.md

Filters for records where an 'uninstallTime' is present. This step is crucial to confirm that an uninstall event was actually recorded, accounting for potential probabilistic nature of selfJoinFilter.

```logscale
| uninstallTime=*
```

--------------------------------

### Use Assignment Operator to Calculate Time Delta

Source: https://github.com/crowdstrike/logscale-community-content/blob/main/CrowdStrike-Query-Language-Map/CrowdStrike-Query-Language/assignment operator.md

Use the assignment operator `:=` to set a field's value to the result of a formula. This example calculates the time difference in seconds.

```LogScale Query Language
timeDeltaSeconds := (now()*1000)-ProcessStartTime
```

--------------------------------

### Add a dynamic URL to query results using format()

Source: https://github.com/crowdstrike/logscale-community-content/wiki/LogScale-Query-Building-Blocks

Creates a markdown-formatted URL that incorporates a value from a search result field. The `%s` placeholder is replaced by the value of the specified field.

```logscale
format("[Link](https://example.com/%s)", field=repo, as=link)
```