Skip to content
SPECIFICTION
Get listed

Query

query.ai

WebAPI
Visit query.ai
Spec score 7.1 #18 of 28 in Query Engine Software

What it is

Query is a cloud security data mesh that searches distributed security sources without copying their data into a central store. Federated search queries connected systems in parallel and normalizes results to OCSF, while Federated Search Query Language translates general queries into each source’s native language at query time. Query Workers are AI agents that triage, investigate, hunt, and detect across connected sources; analysts review recommendations or inconclusive findings. Federated Detections run SPL, KQL, or Sigma rules where the data resides. Query says it supports more than 50 sources, including Splunk, Microsoft Sentinel, CrowdStrike Falcon, Okta, Snowflake, and Google BigQuery. Static connectors map fixed schemas; dynamic connectors let customers configure custom mappings. Access is read-only, with no ingestion required and data staying at its source. The SaaS product runs on AWS data centers in us-east-1. Single sign-on supports Google, Microsoft, and Okta providers. Query states SOC 2 certification, uses NIST CSF 800-53 as a control baseline, and offers weekday standard support plus paid Platinum support.

Spec sheet

Product
Query describes itself as a security data mesh platform that makes security data operational wherever it lives, without requiring migration.Read 7 Oct 2026 · query.ai
Intended users
Query says it is built for security teams seeking answers across distributed security data without centralizing more data.Read 7 Oct 2026 · query.ai
Integrations
Query says it supports more than 50 federated sources, including Splunk, Microsoft Sentinel, CrowdStrike Falcon, Okta, Snowflake, and Google BigQuery.Read 7 Oct 2026 · query.ai
Security
Query says its product design follows a “secure by design” principle and that it has an active bug bounty policy.Read 7 Oct 2026 · query.ai
Support
Standard support is included with subscriptions during weekday business hours, and paid Platinum support is available.Read 7 Oct 2026 · query.ai
Headquarters
The company lists its address as 3423 Piedmont Road NE, Atlanta, GA 30305.Read 7 Oct 2026 · query.ai
Company
Query lists its address as 3423 Piedmont Road NE, Atlanta, GA 30305.Read 7 Oct 2026 · query.ai
AI agents
Query Workers are AI agents that triage, investigate, hunt, and detect across connected sources, with analysts reviewing and deciding on their findings.Read 7 Oct 2026 · query.ai
AI workers
Query Workers are AI agents that triage, investigate, hunt, and detect across connected sources, and provide recommendations or report when evidence is inconclusive.Read 7 Oct 2026 · query.ai
Authentication
The product supports single sign-on through identity providers such as Google, Microsoft, and Okta, and supports Google SSO through OAuth 2.0.Read 7 Oct 2026 · query.ai
Buyer access
The maker offers a personal product walkthrough that customers can schedule through its demo page.Read 7 Oct 2026 · query.ai
Connector types
Static connectors map fixed schemas to Query’s data model, while dynamic connectors let customers configure mappings for custom schemas.Read 7 Oct 2026 · query.ai
Data handling
The mesh is described as read-only, with data staying at its source and no ingestion required.Read 7 Oct 2026 · query.ai
Detections
Federated Detections run detection rules against data where it lives and support translation of SPL, KQL, or Sigma rules.Read 7 Oct 2026 · query.ai
Federated detections
Federated Detections run directly against data where it lives and can translate SPL, KQL, or Sigma rules.Read 7 Oct 2026 · query.ai
Federated search
The platform can search connected sources in parallel and normalize results to OCSF.Read 7 Oct 2026 · query.ai
Hosting
Query describes its product as SaaS hosted on AWS and says its data centers are currently in the United States, in us-east-1.Read 7 Oct 2026 · query.ai
Onboarding
Query says sources can be connected in under 15 minutes without a pipeline project, ETL, or ongoing maintenance.Read 7 Oct 2026 · query.ai
Query language
Federated Search Query Language (FSQL) translates platform-agnostic queries into each source’s native language at query time.Read 7 Oct 2026 · query.ai
Read-only access
The platform describes its data access as read-only, with no DDL risk, no ingestion, and data remaining at its source.Read 7 Oct 2026 · query.ai
Security compliance
Query states that it is SOC 2 certified and uses NIST CSF 800-53 as a baseline for controls.Read 7 Oct 2026 · query.ai
Security limitation
The security page says role-based access controls are not currently supported in the product.Read 7 Oct 2026 · query.ai
Splunk
Query for Splunk extends Splunk to connected mesh sources without ingestion, with analysts working in the Splunk console.Read 7 Oct 2026 · query.ai

Strong points and limits

Strong points

  • Searches connected sources without ingestion
  • Normalizes federated results to OCSF
  • AI workers assist investigations and detection
  • Supports SPL, KQL, and Sigma translation
  • SOC 2 certified with SSO options

Limits

  • Role-based access controls are not currently supported
  • Hosted in United States AWS region us-east-1
  • Paid Platinum support is separate

Who it suits

Query suits security teams that need cross-source answers while keeping data in existing systems. It is intended for organizations using distributed security data and cloud-hosted workflows.

Verdict

Query provides read-only federated search, detections, and AI-assisted investigation across heterogeneous security sources. Its connector model and broad integrations reduce centralization needs, but the current lack of role-based access controls matters for access governance.

Where Specifiction places it

Alternatives to QueryAll alternatives →