Query review
A focused cloud query engine for investigating security data across connected platforms.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Query is a cloud-based security data mesh and federated search platform for security operations teams. It lets analysts query connected SIEMs, data lakes, endpoint, identity, network, SaaS, and other security platforms without first centralizing the data. FSQL provides a unified search language, while OCSF-based normalization helps align results across sources. The Quick Start plan lists federated security search as its highlighted capability, and the platform is available through the web, REST API, and Chrome extension.
Its strongest fit is an investigation workflow that spans a mixed security stack. Query supports static and dynamic source connectors, query planning, and parallel execution across platforms. Integrations include Splunk, Microsoft Sentinel, AWS Security Lake, CrowdStrike Falcon, Okta, Microsoft Entra ID, Snowflake, Google BigQuery, Databricks, AWS Athena, Azure Log Analytics, ServiceNow, Cribl Search, Google SecOps, and Amazon Redshift. Scheduled federated detections extend the query model into recurring monitoring, while security data pipelines can send information to storage and analytics destinations. The REST API returns JSON and server-sent event responses, and the Chrome extension enables right-click federated searches.
Query also adds AI agents for triage, investigation, hunting, and detection, giving security teams another way to work across distributed sources. Its focus is narrower than a general-purpose query engine: the product is built around security operations, federated investigation, and connected security data rather than broad analytics use cases. Teams with heterogeneous security environments and a need to investigate data in place should consider Query. Organizations seeking a general query engine, a non-cloud deployment, or a standard SQL experience should look for a product aligned with those requirements instead.
Query pros and cons
- Where it wins
- Searches across connected security sources without centralizing data first
- Normalizes results with FSQL and an OCSF-based data model
- Adds scheduled detections, pipelines, APIs, and AI investigation agents
- Where it doesn't
- Its scope is specialized for security operations teams
- Cloud deployment may not suit teams requiring another model
- FSQL is a distinct search language rather than standard SQL
Query fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update