LogScale Queries
Collector 1.11.5 · Release notes

LogScale Query Exchange

Share, discover, and version LogScale queries, parsers, dashboards, and how-tos with the community.

Browse queriesUpload
143 queries0 parsers2 dashboards0 how-tos1 contributors
ComplianceDetection & MonitoringIncident ResponseInfrastructureInvestigation & TroubleshootingMicrosoftNetwork & Security
See all recent activity →

Latest queries

Recently shared by the community.

View all →
query.txt
#event_simpleName=UserLogon
| UserName!=/^DWM-/i
| UserName!=/^UMFD-/i
| UserName!=/^Lokaler Dienst/i

Endpoint login activity across corporate devices

v1

This query shows endpoint login events collected from corporate Windows laptops throughout the day. The log data includes device identifiers, hardware information, usernames, and login timestamps, providing visibility into user authentication activity across the managed workstation fleet. You can also exclude additional usernames. This query is based on the Falcon Data Replicator repository.

LogScaleInfrastructureAuthenticationEndpointInvestigation

@sebastian · 30.7.2026

DownloadOpen
query.txt
// Get ReflectiveDotnetModuleLoad with non-null ManagedPdbBuildPath field.
#event_simpleName=ReflectiveDotnetModuleLoad event_platform=Win ManagedPdbBuildPath!=""

// Capture FilePath and FileName Fields

Hunt PBD File Paths in Reflective .net Module Loads

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Hunt PBD File Paths in Reflective .net Module Loads.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Hunt%20PBD%20File%20Paths%20in%20Reflective%20.net%20Module%20Loads.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get OsVersionInfo events; sent by sensor every 24-hours or at sensor start or update
#event_simpleName=OsVersionInfo
 
// Narrow search to only include Linux, Container, and K8 systems

CVE-2025-1146 System Scoping (OsVersionInfo with Logon Data)

v2

The query below will look for Linux systems (Linux, K8, Containers) that need to be updated against CVE-2025-1146. The query is based on the event OsVersionInfo which is generated every 24-hours, at sensor start, or at sensor update. It attempts to merge in LogonType 2 and 10 to determine the last logged on user.

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen

Latest parsers

Recently shared ingest parsers.

View all →

No parsers published yet.

Upload parser

Latest dashboards

Recently shared dashboard definitions.

View all →
dashboard.json
name: User Dashboard
timeSelector:
  defaultTimeJumpInMs: 30000
sharedTimeInterval:

Admin Dashboard for user logins to Omnissa Horizon

v1

Provides a centralized overview of user logins across virtual desktop environments. The dashboard links activity to specific desktop pools (e.g., Windows 7 and Windows 10) and tracks concurrent logins, enabling administrators to monitor users who are simultaneously accessing multiple pools. You can change the poolIds to match your environment.

DashboardEndpoint

@sebastian · 24.7.2026

DownloadOpen

Latest how-tos

Recently shared guides and walkthroughs.

View all →

No how-tos published yet.