LogScale Queries
Collector 1.11.5 · Release notes

LogScale Query Exchange

Share, discover, and version LogScale queries, parsers, dashboards, and how-tos with the community.

142 queries0 parsers1 dashboards0 how-tos1 contributors
Browse queriesBrowse parsersBrowse dashboardsBrowse how-tos

Browse by category

ComplianceDetection & MonitoringIncident ResponseInfrastructureInvestigation & TroubleshootingMicrosoftNetwork & Security
See all recent activity →

Latest queries

Recently shared by the community.

View all →
query.txt
// Get ReflectiveDotnetModuleLoad with non-null ManagedPdbBuildPath field.
#event_simpleName=ReflectiveDotnetModuleLoad event_platform=Win ManagedPdbBuildPath!=""

// Capture FilePath and FileName Fields

Hunt PBD File Paths in Reflective .net Module Loads

v2

Community LogScale query imported from CrowdStrike/logscale-community-content. Source file: Queries-Only/Helpful-CQL-Queries/Hunt PBD File Paths in Reflective .net Module Loads.md. Origin URL: https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Hunt%20PBD%20File%20Paths%20in%20Reflective%20.net%20Module%20Loads.md

LogScaleInvestigation & TroubleshootingDetectionEndpointInvestigation

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get OsVersionInfo events; sent by sensor every 24-hours or at sensor start or update
#event_simpleName=OsVersionInfo
 
// Narrow search to only include Linux, Container, and K8 systems

CVE-2025-1146 System Scoping (OsVersionInfo with Logon Data)

v2

The query below will look for Linux systems (Linux, K8, Containers) that need to be updated against CVE-2025-1146. The query is based on the event OsVersionInfo which is generated every 24-hours, at sensor start, or at sensor update. It attempts to merge in LogonType 2 and 10 to determine the last logged on user.

LogScaleDetection & MonitoringAuthenticationDetectionEndpoint

@sebastian · 25.7.2026

DownloadOpen
query.txt
// Get OsVersionInfo events; sent by sensor every 24-hours or at sensor start or update
#event_simpleName=OsVersionInfo
 
// Narrow search to only include Linux, Container, and K8 systems

CVE-2025-1146 System Scoping (OsVersionInfo)

v2

The query below will look for Linux systems (Linux, K8, Containers) that need to be updated against CVE-2025-1146. The query is based on the event OsVersionInfo which is generated every 24-hours, at sensor start, or at sensor update.

LogScaleDetection & MonitoringDetectionEndpointKubernetes

@sebastian · 25.7.2026

DownloadOpen

Latest parsers

Recently shared ingest parsers.

View all →

No parsers published yet.

Upload parser

Latest dashboards

Recently shared dashboard definitions.

View all →
dashboard.json
name: User Dashboard
timeSelector:
  defaultTimeJumpInMs: 30000
sharedTimeInterval:

Admin Dashboard for user logins to Omnissa Horizon

v1

Provides a centralized overview of user logins across virtual desktop environments. The dashboard links activity to specific desktop pools (e.g., Windows 7 and Windows 10) and tracks concurrent logins, enabling administrators to monitor users who are simultaneously accessing multiple pools. You can change the poolIds to match your environment.

DashboardEndpoint

@sebastian · 24.7.2026

DownloadOpen

Latest how-tos

Recently shared guides and walkthroughs.

View all →

No how-tos published yet.