Query

Paid APIWeb

What Query is

Query is a cloud security data mesh for teams that need to investigate information across distributed security sources without bringing it into a central store. Its federated search runs across connected sources in parallel and normalizes results to OCSF. Federated Search Query Language translates platform-independent queries into each source’s native language at query time. Query Workers are AI agents that can triage, investigate, hunt, and detect; analysts review their findings and decide what to do. They can also recommend actions or report when evidence is inconclusive. Federated Detections run rules where the data resides and can translate SPL, KQL, or Sigma rules. Query says it supports more than 50 federated sources, including Splunk, Microsoft Sentinel, CrowdStrike Falcon, Okta, Snowflake, and Google BigQuery. Static connectors map fixed schemas, while dynamic connectors allow customers to configure mappings for custom schemas. The service is read-only, requires no ingestion, and is SaaS hosted on AWS, with data centers in the United States in us-east-1. It supports single sign-on through providers including Google, Microsoft, and Okta. Query is headquartered in Atlanta, Georgia.

Who it suits

Query suits security teams that need to search across distributed security data while leaving it at its source. It may also suit organizations using supported connected sources and seeking federated detections or AI-assisted investigation with analyst review.

What it does well

Searches connected sources in parallel and normalizes results to OCSF.
FSQL translates queries into each connected source’s native language.
Workers support triage, investigation, hunting, and detection.
Read-only access keeps data at its source without ingestion.
Supports single sign-on through Google, Microsoft, and Okta.

What to know first

Role-based access controls are not currently supported.

Limits

Role-based access controls are not currently supported in the product.

Getting started

Visit https://www.query.ai/ and schedule a personal product walkthrough through the demo page.
Connect security data sources; Query says this can be done in under 15 minutes.
Use supported identity-provider single sign-on, including Google, Microsoft, or Okta.
Run federated searches or detections across connected sources.

Verdict

Choose Query if your security team needs to search distributed sources without centralizing their data, or run detections where that data resides. Look elsewhere if role-based access controls are a requirement.

Questions

What does Query do?

It searches distributed security data across connected sources without moving it into a centralized store. It also offers AI Workers and federated detections.

Which sources does Query support?

Query says it supports more than 50 federated sources, including Splunk, Microsoft Sentinel, CrowdStrike Falcon, Okta, Snowflake, and Google BigQuery.

What platforms and deployment does it support?

The listed platforms are API and web. Query describes the product as SaaS hosted on AWS, with data centers currently in us-east-1 in the United States.

How is data handled?

The mesh is described as read-only, with data staying at its source and no ingestion required.

What does Query cost?

Query is a paid product. Standard support is included with subscriptions during weekday business hours, and paid Platinum support is available.

Does Query support role-based access controls?

No. Query says role-based access controls are not currently supported.

Facts from Query's own pages

AI agents: Query Workers are AI agents that triage, investigate, hunt, and detect across connected sources, with analysts reviewing and deciding on their findings. · query.ai, 7 Oct 2026
AI workers: Query Workers are AI agents that triage, investigate, hunt, and detect across connected sources, and provide recommendations or report when evidence is inconclusive. · query.ai, 7 Oct 2026
Authentication: The product supports single sign-on through identity providers such as Google, Microsoft, and Okta, and supports Google SSO through OAuth 2.0. · query.ai, 7 Oct 2026
Buyer access: The maker offers a personal product walkthrough that customers can schedule through its demo page. · query.ai, 7 Oct 2026
Company: Query lists its address as 3423 Piedmont Road NE, Atlanta, GA 30305. · query.ai, 7 Oct 2026
Connector types: Static connectors map fixed schemas to Query’s data model, while dynamic connectors let customers configure mappings for custom schemas. · query.ai, 7 Oct 2026
Data handling: The mesh is described as read-only, with data staying at its source and no ingestion required. · query.ai, 7 Oct 2026
Detections: Federated Detections run detection rules against data where it lives and support translation of SPL, KQL, or Sigma rules. · query.ai, 7 Oct 2026
Federated detections: Federated Detections run directly against data where it lives and can translate SPL, KQL, or Sigma rules. · query.ai, 7 Oct 2026
Federated search: The platform can search connected sources in parallel and normalize results to OCSF. · query.ai, 7 Oct 2026
Headquarters: The company lists its address as 3423 Piedmont Road NE, Atlanta, GA 30305. · query.ai, 7 Oct 2026
Hosting: Query describes its product as SaaS hosted on AWS and says its data centers are currently in the United States, in us-east-1. · query.ai, 7 Oct 2026
Integrations: Query says it supports more than 50 federated sources, including Splunk, Microsoft Sentinel, CrowdStrike Falcon, Okta, Snowflake, and Google BigQuery. · query.ai, 7 Oct 2026
Intended users: Query says it is built for security teams seeking answers across distributed security data without centralizing more data. · query.ai, 7 Oct 2026
Onboarding: Query says sources can be connected in under 15 minutes without a pipeline project, ETL, or ongoing maintenance. · query.ai, 7 Oct 2026
Product: Query is a security data mesh platform that searches distributed security data without moving it to a centralized store. · query.ai, 7 Oct 2026
Query language: Federated Search Query Language (FSQL) translates platform-agnostic queries into each source’s native language at query time. · query.ai, 7 Oct 2026
Read-only access: The platform describes its data access as read-only, with no DDL risk, no ingestion, and data remaining at its source. · query.ai, 7 Oct 2026
Security: Query says its product design follows a “secure by design” principle and that it has an active bug bounty policy. · query.ai, 7 Oct 2026
Security compliance: Query states that it is SOC 2 certified and uses NIST CSF 800-53 as a baseline for controls. · query.ai, 7 Oct 2026
Security limitation: The security page says role-based access controls are not currently supported in the product. · query.ai, 7 Oct 2026
Splunk: Query for Splunk extends Splunk to connected mesh sources without ingestion, with analysts working in the Splunk console. · query.ai, 7 Oct 2026
Support: Standard support is included with subscriptions during weekday business hours, and paid Platinum support is available. · query.ai, 7 Oct 2026

Where Query stands on Freedom251

Query Engine Software#21 of 28