Query Federated Search App for Splunk is a Splunk application that enables security analysts to perform federated searches across multiple distributed data sources directly from within Splunk. The app connects to a wide range of cloud, SaaS, and on-premises technologies via API connectors, allowing users to query data without centralizing it into a single repository. Connections are established through an organization-based account structure, where users configure integrations using credentials such as URLs, API keys, and authentication tokens. Once integrations are configured, users can search across all connected data sources using natural language queries. The app is designed to reduce onboarding time, with Query.AI claiming users can begin searching data within 30 minutes of setup. Supported data source categories include: - Cloud Infrastructure & Data Lakes (e.g., Amazon Athena, Amazon Security Lake, Google BigQuery) - Email Security & Communication (e.g., Cofense, Microsoft Defender for Office 365) - Endpoint (e.g., CrowdStrike Falcon, SentinelOne, VMware Carbon Black EDR, Microsoft Defender for Endpoint) - Identity & HR (e.g., Okta, Auth0, Microsoft Entra ID, Microsoft Active Directory) - IT Service Management (e.g., ServiceNow) - Mobile Device Management (e.g., JAMF, Microsoft Intune) - SIEM & Log Management (e.g., Splunk Enterprise & Cloud, Datadog) - Threat Intelligence & Enrichment (e.g., AlienVault OTX, VirusTotal, Shodan, WhoisXMLAPI, Tégo Threat Feed) The app is managed by Query.AI, which maintains the API connectors on behalf of users.