logscale

CrowdStrike Falcon Advanced Threat Hunting Queries

Best Practices, queries, and packages for CQL the language of CrowdStrike's LogScale (Humio) log manager.

A VS Code extension for for LogScale Query Language (formerly Humio) syntax highlighting.

Complete set up guide for Humio now as Falcon Logscale on single node self hosted server.

Obsidian plugin — CQL syntax highlighting for CrowdStrike LogScale

RMM Tools list files for hunting in CrowdStrike / Logscale

CrowdStrike CQL threat-hunting packs — one self-contained playbook per threat (MITRE ATT&CK, IOCs, triage, hardening)

Will check humio and other contemporary servers status depended to it

Docker container for shipping JSON data from an API call to a Logscale repository

matplotlib benchmarks and useful use cases

Falcon LogScale Alert action for Pushover (https://pushover.net)

A Falcon LogScale package for monitoring and visualising data about a Nextcloud server

Shell script to pull data from shelly devices (https://www.shelly.cloud) and send to Falcon LogScale HEC endpoint

A collection of scripts and parsers to extract DNS query logs from a Pihole instance and ingest them into the Falcon Logscale (Humio) platform.

Synthetic SIEM endpoints in real-vendor shapes for SOAR/agent integration testing. LogScale + QRadar surfaces, 22 multi-source attack scenarios, MIT-licensed.

Apispark is a tool to consume an api and send the response to a Logscale repository.

Fixture-validated Sigma detections compiled for Elastic and CrowdStrike LogScale with evidence manifests, CI, and documented validation boundaries.

Create a powershell DSC configuration file for use in a group policy to distribute and enroll the Falcon LogScale Collector.

Step-by-step guide to building a highly available Falcon LogScale Collector setup with keepalived + VIP failover.