Query
Query is a cloud security data mesh for security teams that need to search across distributed data without moving it into a central store.
What Query is
Query is a cloud security data mesh for security teams that need to search across distributed data without moving it into a central store. Its federated search queries connected sources in parallel, while Federated Search Query Language (FSQL) translates queries into each source’s native language. Results can be normalized to OCSF. Query Workers are AI agents that triage, investigate, hunt, and detect; analysts review their findings, which may include recommendations or a report that evidence is inconclusive. Federated Detections run rules where the data lives and can translate SPL, KQL, or Sigma rules. Query says it supports more than 50 sources, including Splunk, Microsoft Sentinel, CrowdStrike Falcon, Okta, Snowflake, and Google BigQuery. The read-only mesh leaves data at its source and requires no ingestion. The SaaS product is hosted on AWS, with data centers in the United States. It supports single sign-on through providers including Google, Microsoft, and Okta. Query says it is SOC 2 certified and uses NIST CSF 800-53 as a control baseline. Pricing is paid; the product is available via web and API.
Good
- Searches connected sources in parallel.
- Normalizes search results to OCSF.
- Read-only access requires no ingestion.
- Supports SSO through Google, Microsoft, and Okta.
Watch out
- Role-based access controls are not currently supported.
- Paid product; no price is listed.
- Data centers are currently in the United States.
Who it suits
It suits security teams looking for answers across distributed security data without centralizing more data. Teams can connect sources and use federated searches or detections while data stays in place.
Verdict
Query combines federated search, detection rules, and AI-assisted investigation while leaving source data in place. The lack of role-based access controls is an important limitation to consider.
The facts
Each one read from Query's own pages, with the date it was checked.
What it does
- AI agents
- Query Workers are AI agents that triage, investigate, hunt, and detect across connected sources, with analysts reviewing and deciding on their findings.checked 7 Oct 2026
- AI workers
- Query Workers are AI agents that triage, investigate, hunt, and detect across connected sources, and provide recommendations or report when evidence is inconclusive.checked 7 Oct 2026
- Authentication
- The product supports single sign-on through identity providers such as Google, Microsoft, and Okta, and supports Google SSO through OAuth 2.0.checked 7 Oct 2026
- Buyer access
- The maker offers a personal product walkthrough that customers can schedule through its demo page.checked 7 Oct 2026
- Connector types
- Static connectors map fixed schemas to Query’s data model, while dynamic connectors let customers configure mappings for custom schemas.checked 7 Oct 2026
- Data handling
- The mesh is described as read-only, with data staying at its source and no ingestion required.checked 7 Oct 2026
- Detections
- Federated Detections run detection rules against data where it lives and support translation of SPL, KQL, or Sigma rules.checked 7 Oct 2026
- Federated detections
- Federated Detections run directly against data where it lives and can translate SPL, KQL, or Sigma rules.checked 7 Oct 2026
- Federated search
- The platform can search connected sources in parallel and normalize results to OCSF.checked 7 Oct 2026
- Hosting
- Query describes its product as SaaS hosted on AWS and says its data centers are currently in the United States, in us-east-1.checked 7 Oct 2026
- Integrations
- Query says it supports more than 50 federated sources, including Splunk, Microsoft Sentinel, CrowdStrike Falcon, Okta, Snowflake, and Google BigQuery.checked 7 Oct 2026
- Intended users
- Query says it is built for security teams seeking answers across distributed security data without centralizing more data.checked 7 Oct 2026
- Onboarding
- Query says sources can be connected in under 15 minutes without a pipeline project, ETL, or ongoing maintenance.checked 7 Oct 2026
- Product
- Query is a security data mesh platform that searches distributed security data without moving it to a centralized store.checked 7 Oct 2026
- Query language
- Federated Search Query Language (FSQL) translates platform-agnostic queries into each source’s native language at query time.checked 7 Oct 2026
- Read-only access
- The platform describes its data access as read-only, with no DDL risk, no ingestion, and data remaining at its source.checked 7 Oct 2026
- Security
- Query says its product design follows a “secure by design” principle and that it has an active bug bounty policy.checked 7 Oct 2026
- Security compliance
- Query states that it is SOC 2 certified and uses NIST CSF 800-53 as a baseline for controls.checked 7 Oct 2026
- Security limitation
- The security page says role-based access controls are not currently supported in the product.checked 7 Oct 2026
- Splunk
- Query for Splunk extends Splunk to connected mesh sources without ingestion, with analysts working in the Splunk console.checked 7 Oct 2026
- Support
- Standard support is included with subscriptions during weekday business hours, and paid Platinum support is available.checked 7 Oct 2026
The company
- Company
- Query lists its address as 3423 Piedmont Road NE, Atlanta, GA 30305.checked 7 Oct 2026
- Headquarters
- The company lists its address as 3423 Piedmont Road NE, Atlanta, GA 30305.checked 7 Oct 2026
Alternatives to Query
- 1
PrestoDB
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 2
Starburst Enterprise Context Layer
Free planWebAPISelf-hosted7.5$0.50 usage-based - 3
Apache Hive
Free planOpen sourceAPILinuxmacOSSelf-hosted7.4Free plan - 4
IBM Db2
Free planWebAPILinuxSelf-hosted7.4From $630 a month - 5
Starburst Galaxy
Free planWebAPILinux7.1Free plan - 6
Comunica
Free planWebAPILinuxmacOS7.0Free plan