Fusion Query Language (QL)

Fusion Query Language (QL) is the shared search language for Fusion interfaces. Use QL to select schemas, filter results, and set a time range. Event searches can also sort or aggregate results.

Use QL with Data Lake Search and the planned Search API. The Cases GraphQL API and Detections GraphQL API also use QL for supported operations.

Each interface supports a subset of QL. For example, event searches support aggregation, but detection searches do not. Check the guide for the interface that runs your query.

Note on naming: while some API artifacts still use CQL or cql in their field names or schema descriptions, this is a legacy descriptor. The correct name is QL when you refer to the language.

Filter one event schema¶

This query finds process events with a PowerShell image path from the last 24 hours.

from process where image_path contains 'powershell.exe' earliest=-24h

Search more than one event schema¶

Logical types start with @. They let one condition match equivalent fields across schemas. This query searches process and authentication events for a user value.

from process, auth where @user contains 'system' earliest=-12h

Aggregate event results¶

This query counts DNS query events in one-hour time buckets.

from dnsquery earliest=-1d | aggregate count by 1h

QL is not SQL. It searches normalized schemas and does not support relational joins. Start with a narrow time range, then expand it after you verify the results.

For the complete syntax, operators, time ranges, logical types, and limits, see the QL reference.