ENGINEERING CHEATSHEET // FALCON NEXT-GEN SIEM & LOGSCALE CQL
REF: MIG-CQL-2026 • OCTOBER 2026 • PRODUCTION REFERENCE
MIGREA • SIEM TELEMETRY MODERNIZATION PRACTICE

Enterprise SPL / AQL / KQL to CrowdStrike Falcon CQL & CPS Schema Reference Sheet

The definitive field engineer cheat sheet for migrating detections and correlation pipelines from Splunk (SPL), IBM QRadar (AQL), and Microsoft Sentinel (KQL) to CrowdStrike Falcon Next-Gen SIEM & LogScale CQL. Built on the CrowdStrike Parsing Standard (CPS) & OCSF v1.1.0.

TARGET PLATFORM
CrowdStrike Falcon
LogScale Streaming CQL
Source Query Dialects
Splunk SPL • QRadar AQL • Sentinel KQL
Full Operator Parity
Schema Standard
CPS • OCSF v1.1.0
Zero Search-Time Disk I/O
Execution Speed
1.2 GB/s Per Core
Stateless In-Memory RAM
Tenancy & Ownership
100% In-Tenant
Zero 24/7 Managed SOC Lock-In
SECTION 1 // SYNTAX TRANSLATION MATRIX

Operator & Aggregation Translation: SPL vs. AQL vs. KQL vs. Falcon CQL

7 CORE OPERATORS

CrowdStrike Falcon Next-Gen SIEM leverages LogScale’s high-throughput pipelined stream engine. Unlike Splunk’s MapReduce index sweeps, QRadar’s disk-bound Ariel SQL queries, or Sentinel’s Azure Data Explorer pipelines, Falcon CQL executes purely in-memory across columnar log chunks.

Operation Splunk SPL IBM QRadar AQL Microsoft Sentinel KQL CrowdStrike Falcon CQL
Aggregation & Grouping
stats / summarize
 | stats count, dc(dest_port) as d_ports by src_ip SELECT sourceIP, COUNT(*), COUNT(DISTINCT destinationPort) FROM events GROUP BY sourceIP | summarize Total=count(), DPorts=dcount(DestinationPort) by SourceIP | groupBy([LocalAddressIP4], function=[count(), count(RemotePort, distinct=true, as=d_ports)])
Regex Extraction
rex / parse / extract
 | rex field=_raw "user=(?<user>[^ ]+)" SELECT UTF8(payload) FROM events WHERE UTF8(payload) MATCHES 'user=(\w+)' | parse-where RawData with * "user=" User:string " "* | regex("user=(?<UserName>[^ ]+)", field=@rawstring)
Calculated Fields
eval / extend / case
 | eval delta_ms = end_time - start_time, severity = if(score > 80, "CRIT", "INFO") SELECT (endtime - starttime) as delta_ms, CASE WHEN score > 80 THEN 'CRIT' ELSE 'INFO' END FROM events | extend delta_ms = datetime_diff('millisecond', EndTime, StartTime), severity = iff(score > 80, "CRIT", "INFO") | delta_ms := end_time - start_time | case { score > 80 | severity := "CRIT" ; * | severity := "INFO" }
Lookup / Threat Match
lookup / match / in_set
 | lookup ti_intel ip as src_ip OUTPUT actor, malware SELECT * FROM events WHERE REFERENCESETCONTAINS('Malicious_IPs', sourceIP) | lookup ThreatIntel on $left.SourceIP == $right.ThreatIP | match(file="ti_intel.csv", column=ip, field=LocalAddressIP4, include=[actor, malware])
Event Correlation
join / selfJoinFilter
 | join type=inner host [search eventtype=failed_logon | stats count by host] /* Limited AQL support: requires expensive subqueries or Custom Rules Engine */ SigninLogs | join kind=inner (SecurityAlert) on $left.UserId == $right.UserId | selfJoinFilter(field=aid, where=[{#event_simpleName=UserLogonFailed}, {#event_simpleName=ProcessRollup2}])
CIDR Subnet Filter
cidrmatch / in_subnet
 | where cidrmatch("10.0.0.0/8", src_ip) WHERE INCIDR('10.0.0.0/8', sourceIP) | where ipv4_is_in_range(SourceIP, "10.0.0.0/8") | cidr(LocalAddressIP4, subnet="10.0.0.0/8")
Time Aggregation
timechart / bucket / bin
 | timechart span=1h count by event_type SELECT DATEFORMAT(starttime, 'YYYY-MM-dd HH:00'), COUNT(*) GROUP BY 1 | summarize count() by bin(TimeGenerated, 1h), EventType | bucket(span=1h, field=@timestamp, function=count())
Architectural Takeaway: LogScale CQL utilizes pipelined data transformation with zero inverted indexing. Unlike Splunk eval and Sentinel extend, CQL assignments (:=) execute as direct register operations on the CPU, achieving sub-second latency over terabytes of raw logs.
SECTION 2 // SCHEMA NORMALIZATION STANDARD

CrowdStrike Parsing Standard (CPS) & OCSF Field Mapping

OCSF v1.1.0 COMPLIANT

Legacy SIEMs rely on search-time schema binding (Splunk CIM) or appliance parsing tables (QRadar DSMs). CrowdStrike Falcon Next-Gen SIEM standardizes on the CrowdStrike Parsing Standard (CPS) and Open Cybersecurity Schema Framework (OCSF) at ingestion. The table below provides the authoritative cross-mapping.

Canonical Entity Splunk CIM QRadar DSM Sentinel ASIM Falcon CPS & OCSF Attribute
Primary Event Type
Taxonomy discriminator
 sourcetype / eventtype qid / devicetype Type / EventID #event_simpleName
e.g. ProcessRollup2, UserLogon
Source IP Address
Initiating origin
 src / src_ip sourceIP / SourceAddress CallerIpAddress / SourceIP LocalAddressIP4 (Internal)
aip (Agent IP) / src_endpoint.ip
Destination IP Address
Target address
 dest / dest_ip destinationIP / DestinationAddress DestinationIP / DestinationIpAddress RemoteAddressIP4 / dst_endpoint.ip
Destination Port
Target port
 dest_port destinationPort DestinationPort RemotePort / dst_endpoint.port
User / Target Account
Identity subject
 user / TargetUserName userName / TargetUserName TargetUserName / Account / UserPrincipalName UserName / TargetUser
actor.user.name / UserId
Process Image & Name
Binary execution
 process_name / Image Image / ProcessName ProcessName / NewProcessName FileName / TargetFileName
process.name / ImageFileName
Process Command Line
Full parameter string
 process_exec / CommandLine CommandLine / ProcessCommandLine CommandLine / ProcessCommandLine CommandLine / process.cmd_line
Host & Agent ID
Physical / virtual node
 host / ComputerName logsourceid / HostName Computer / DvcHostname aid (Falcon Agent GUID)
ComputerName / device.hostname
File Hashes
Cryptographic signature
 file_hash / sha256 FileHash / SHA256 TargetFileHash / SHA256 SHA256HashData / MD5HashData
file.hash.sha256
OCSF Class 1007
Process Activity

Maps process launch, termination, and code injection with unified parent lineage attributes.

OCSF Class 4001
Network Activity

Harmonizes endpoint sockets, firewall sessions, and VPC flow logs into src_endpoint and dst_endpoint.

OCSF Class 3002
Authentication

Unifies Windows Kerberos/NTLM, Entra ID tokens, Okta SAML, and PAM sessions into canonical logon outcomes.

SECTION 3 // PRODUCTION DETECTION LIBRARY

Top 5 Production-Ready Falcon CQL Correlation Rules

MITRE ATT&CK VALIDATED

These production-grade detection templates demonstrate high-performance CQL idioms: streaming in-memory evaluation, bitset aggregation, cross-telemetry correlation with selfJoinFilter, and direct trigger gating for Falcon Fusion SOAR automation.

RULE 01 // MITRE T1059.001

Obfuscated PowerShell EncodedCommand Execution

Telemetry: #event_simpleName=ProcessRollup2 
// Detect obfuscated base64 PowerShell executions with child process spawning
#event_simpleName=ProcessRollup2 FileName=/powershell\.exe|pwsh\.exe/i
| test(CommandLine = /(?i)\s+-(e|enc|encodedcommand)\s+[A-Za-z0-9+/=]{20,}/)
| match(regex="(?i)(Invoke-Expression|IEX|DownloadString|BitTransfer|WebClient)", field=CommandLine)
| select([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, CommandLine])

Engineering Note: In Splunk, searching regex over Windows event 4688 or Sysmon 1 saturates search head CPU cores. In Falcon LogScale CQL, Rust-compiled regex filters stream at wire speed with < 150 ms response times.

RULE 02 // MITRE T1558.003

Active Directory Kerberoasting Service Ticket Request Surge

Telemetry: Windows Security 4769 / DC Connector 
// Detect rapid requests for Kerberos TGS tickets with weak RC4 encryption (0x17)
#event_simpleName=UserLogon or #event_simpleName=ServiceTicketRequested
| TicketEncryptionType = "0x17"
| ServiceName != "*$" and ServiceName != "krbtgt"
| groupBy([TargetUserName, ComputerName], function=[
    count(ServiceName, distinct=true, as=DistinctSPNs),
    collect(ServiceName, limit=10),
    count(as=TotalRequests)
  ])
| test(DistinctSPNs > 5)

Engineering Note: Replaces QRadar’s disk-bound Ariel flow joins. LogScale’s HyperLogLog registers compute distinct SPNs in RAM across millions of DC logs without breaching EPS limits.

RULE 03 // MITRE T1078.004 / T1098

Entra ID Privileged PIM Role Elevation & Risky Sign-In

Telemetry: Entra ID Audit & Sign-In Connectors 
// Correlate privileged Entra role activation with unusual geographic origin
#event_simpleName=IdentityAuditEvent
| in(OperationName, values=["Add member to role", "Add eligible member to role (PIM)"])
| match(regex="(?i)(Global Administrator|Security Administrator|Privileged Role)", field=TargetRole)
| selfJoinFilter(field=TargetUser, where=[
    {#event_simpleName=UserLoggedIn, RiskLevel=/high|medium/i},
    {#event_simpleName=IdentityAuditEvent}
  ])
| select([@timestamp, TargetUser, InitiatedByUser, TargetRole, ClientIP, RiskLevel])

Engineering Note: In Microsoft Sentinel, correlating Entra AuditLogs and SigninLogs requires nested KQL joins that breach query memory limits. Falcon selfJoinFilter executes in a single linear pass.

RULE 04 // MITRE T1046

Internal Network Port Sweep & Firewall Drop Surge

Telemetry: NetworkConnectIP4 / Palo Alto / Fortinet Connector 
// Detect internal reconnaissance scanning multiple destination ports
#event_simpleName=NetworkConnectIP4
| cidr(RemoteAddressIP4, subnet="10.0.0.0/8") or cidr(RemoteAddressIP4, subnet="172.16.0.0/12")
| test(Action = /reject|drop|blocked|denied/i)
| groupBy([LocalAddressIP4], function=[
    count(RemotePort, distinct=true, as=DistinctPorts),
    count(RemoteAddressIP4, distinct=true, as=DistinctDestIPs),
    count(as=TotalDrops)
  ])
| test(DistinctPorts > 35 and TotalDrops > 150)

Engineering Note: Eliminates Splunk Heavy Forwarder preprocessing. Ingests raw firewall Syslog directly through Falcon Data Connectors with real-time bitmask evaluation.

RULE 05 // SOAR AUTOMATION GATING

Falcon Fusion SOAR Correlation & Rapid Host Containment

Trigger Target: Falcon Fusion Workflow Engine 
// High-fidelity correlation triggering automated network containment & session kill
#event_simpleName=DetectionSummaryEvent or #event_simpleName=ProcessRollup2
| Severity >= 4 or test(CommandLine = /(?i)(vssadmin.*delete.*shadows|bcdedit.*recoveryenabled.*no)/)
| select([@timestamp, aid, ComputerName, LocalAddressIP4, UserName, CommandLine, Severity])
// Payload feeds directly into Falcon Fusion SOAR Trigger:
// Action 1: falcon:contain-host(aid=aid)
// Action 2: entra:revoke-user-sessions(user=UserName)
// Action 3: jira:create-incident(priority="Critical")

Engineering Note: In legacy SIEMs, SOAR webhooks require polling or external orchestrators (Splunk SOAR / Cortex XSOAR). Falcon Fusion operates natively inside the kernel pipeline, containing compromised hosts in < 90 seconds.

SECTION 4 // ARCHITECTURAL ENGAGEMENT

The Migrea Doctrine: Build, Validate, Transfer Keys

ZERO MANAGED SOC LOCK-IN

We believe enterprise security teams should own their detection IP, administrative credentials, and SIEM infrastructure. Migrea is strictly a fixed-milestone SIEM cutover engineering practice. We do not sell 24/7 Managed SOC retainers, and we do not act as a software broker.

100% In-Tenant Delivery

All connectors, LogScale parsers, CQL rules, and Fusion workflows are built directly inside your corporate CrowdStrike tenant. Zero data egress.

30-Day Parallel SLA & 30-Day Logic Warranty

30-day bound parallel run validation where every alert is verified against Falcon CQL output, backed by a 30-day post-cutover logic warranty covering false-positive suppression.

Fixed-Price Milestone SOWs • Zero MDR Lock-In

Build, Validate, Transfer Keys. We never compete with or upsell 24/7 Managed SOC operations. Standard Tier 1 ($24,500), Hybrid Cutover Tier 2 ($38,500), and Complex Tier 3 ($64,500).

PHASE 0 EVALUATION & SCOPING

5-Day Telemetry & Detection Rule Health Check

Reserve our fixed-scope 5-Day Technical Health Check ($3,500 USD). We audit your active legacy rules, ingestion noise, and schema drift. 100% credited against your cutover SOW.

Fixed Audit Fee
$3,500 USD
100% Credited to SOW
Schedule Cutover Scoping → Model TCO & Storage Savings in Evaluator → Explore Migration Tiers →