logscale

Best Practices, queries, and packages for CQL the language of CrowdStrike's LogScale (Humio) log manager.

CrowdStrike Falcon Advanced Threat Hunting Queries

A VS Code extension for for LogScale Query Language (formerly Humio) syntax highlighting.

Complete set up guide for Humio now as Falcon Logscale on single node self hosted server.

RMM Tools list files for hunting in CrowdStrike / Logscale

Obsidian plugin — CQL syntax highlighting for CrowdStrike LogScale

CrowdStrike CQL threat-hunting packs — one self-contained playbook per threat (MITRE ATT&CK, IOCs, triage, hardening)

Will check humio and other contemporary servers status depended to it

Docker container for shipping JSON data from an API call to a Logscale repository

matplotlib benchmarks and useful use cases

Falcon LogScale Alert action for Pushover (https://pushover.net)

A Falcon LogScale package for monitoring and visualising data about a Nextcloud server

Shell script to pull data from shelly devices (https://www.shelly.cloud) and send to Falcon LogScale HEC endpoint

A collection of scripts and parsers to extract DNS query logs from a Pihole instance and ingest them into the Falcon Logscale (Humio) platform.

Synthetic SIEM endpoints in real-vendor shapes for SOAR/agent integration testing. LogScale + QRadar surfaces, 22 multi-source attack scenarios, MIT-licensed.

Apispark is a tool to consume an api and send the response to a Logscale repository.

Fixture-validated Sigma detections compiled for Elastic and CrowdStrike LogScale with evidence manifests, CI, and documented validation boundaries.

Create a powershell DSC configuration file for use in a group policy to distribute and enroll the Falcon LogScale Collector.

Step-by-step guide to building a highly available Falcon LogScale Collector setup with keepalived + VIP failover.