Query Workers can now be triggered from inside Falcon, with findings and indicators sent to an AI Worker using the Query Data Mesh.

Security operations beyond your SIEM. Less than half your security-relevant data lives in your SIEM. The rest is scattered across data lakes, endpoint, identity, network, and IT tools your team can't easily reach. Coverage becomes a budget decision, not a security one. Query changes that. Our Security Data Mesh makes your data operational wherever it lives. No migration, no ingestion penalty, no centralization tax. Connect a new source in under 15 minutes and put 100% of your data to work. What runs on the mesh: Query Workers — AI agents that triage, investigate, hunt, and prioritize across every connected source. A typical investigation takes ~15 minutes versus 8–12 hours of manual triage. They show evidence and recommend; your team decides. No black box. Federated Detections — detection logic decoupled from data storage across 50+ sources. Bring your SPL, KQL, or Sigma rules, or use ours. Federated Search & Analytics — one console across every source, in parallel. Natural language in, any source out. Query for Splunk — extend Splunk to every source without ingestion, inside the console your analysts already use. The result: every alert investigated, every threat hunted, analysts doing security work instead of data assembly — and AI reasoning across all your data, not just the slice your SIEM ingested. See for yourself: query.ai/book-a-demo

Founded 2018