Query.AI Federated Detections

Query Federated Detections is a detection engine that runs security detection logic directly against distributed data sources without requiring data to be centralized or ingested into a SIEM first. It operates via the Query Security Data Mesh, allowing detections to execute across cloud services, SaaS platforms, security tools, object storage, data lakes, and SIEMs wherever the data resides. Detections are defined as scheduled queries written in Federated Search Query Language (FSQL), which supports windowed aggregations, rate calculations, grouping by users/identities/IPs/resources/assets, and threshold-based match conditions. Each detection runs on a defined cadence with an explicit evaluation window, and execution metadata — including time range evaluated, source coverage, and match counts — is recorded for auditability. When a detection fires, a finding is generated along with a replay link that allows analysts to rerun the exact detection logic against the original time window. From findings, analysts can review normalized results across contributing sources and pivot into related entities and events using federated search. Detection authoring is supported natively in FSQL, with additional options to convert from SPL, KQL, or Sigma rules, generate FSQL from natural language prompts, or start from a library of 1,000+ pre-built detection recipes. Findings can be delivered to chat, ticketing, and incident response tools already in use. No ETL pipelines, data duplication, or centralized storage is required.