Query
The company lists its address as 3423 Piedmont Road NE, Atlanta, GA 30305.
What it is
Query is a cloud security data mesh that searches distributed security information without moving it into a central repository. Federated search queries connected sources in parallel and normalizes results to OCSF. Federated Search Query Language translates general queries into each source’s native language at query time. Query Workers are AI agents that triage, investigate, hunt, and detect across connected sources; analysts review their findings, recommendations, or inconclusive reports. Federated Detections run rules where data resides and translate SPL, KQL, or Sigma rules. Query says it supports more than 50 sources, including Splunk, Microsoft Sentinel, CrowdStrike Falcon, Okta, Snowflake, and Google BigQuery. Static connectors map fixed schemas, while dynamic connectors handle custom mappings. Access is read-only, with no ingestion required and data remaining at its source. The SaaS product is hosted on AWS in US East, supports single sign-on through Google, Microsoft, and Okta, and states SOC 2 certification. Role-based access controls are not currently supported.
For and against
For
- Searches connected sources in parallel
- Leaves data at its original source
- AI workers assist investigation and hunting
- Translates SPL, KQL, and Sigma
- Supports more than 50 sources
Against
- Role-based access controls are not supported
- SaaS data centers are currently in the United States
- Paid product
The verdict
Query provides federated search, detections, and AI-assisted investigation while keeping source data in place. Teams should weigh its read-only design against the stated absence of role-based access controls.
Who it suits
Query is aimed at security teams investigating distributed data without centralizing it. It fits organizations using supported security, identity, analytics, or cloud data sources.
On the record
- AI agents
- Query Workers are AI agents that triage, investigate, hunt, and detect across connected sources, with analysts reviewing and deciding on their findings.query.ai · read 7 Oct 2026
- AI workers
- Query Workers are AI agents that triage, investigate, hunt, and detect across connected sources, and provide recommendations or report when evidence is inconclusive.query.ai · read 7 Oct 2026
- Authentication
- The product supports single sign-on through identity providers such as Google, Microsoft, and Okta, and supports Google SSO through OAuth 2.0.query.ai · read 7 Oct 2026
- Buyer access
- The maker offers a personal product walkthrough that customers can schedule through its demo page.query.ai · read 7 Oct 2026
- Company
- Query lists its address as 3423 Piedmont Road NE, Atlanta, GA 30305.query.ai · read 7 Oct 2026
- Connector types
- Static connectors map fixed schemas to Query’s data model, while dynamic connectors let customers configure mappings for custom schemas.query.ai · read 7 Oct 2026
- Data handling
- The mesh is described as read-only, with data staying at its source and no ingestion required.query.ai · read 7 Oct 2026
- Detections
- Federated Detections run detection rules against data where it lives and support translation of SPL, KQL, or Sigma rules.query.ai · read 7 Oct 2026
- Federated detections
- Federated Detections run directly against data where it lives and can translate SPL, KQL, or Sigma rules.query.ai · read 7 Oct 2026
- Federated search
- The platform can search connected sources in parallel and normalize results to OCSF.query.ai · read 7 Oct 2026
- Hosting
- Query describes its product as SaaS hosted on AWS and says its data centers are currently in the United States, in us-east-1.query.ai · read 7 Oct 2026
- Integrations
- Query says it supports more than 50 federated sources, including Splunk, Microsoft Sentinel, CrowdStrike Falcon, Okta, Snowflake, and Google BigQuery.query.ai · read 7 Oct 2026
- Intended users
- Query says it is built for security teams seeking answers across distributed security data without centralizing more data.query.ai · read 7 Oct 2026
- Onboarding
- Query says sources can be connected in under 15 minutes without a pipeline project, ETL, or ongoing maintenance.query.ai · read 7 Oct 2026
- Product
- Query describes itself as a security data mesh platform that makes security data operational wherever it lives, without requiring migration.query.ai · read 7 Oct 2026
- Query language
- Federated Search Query Language (FSQL) translates platform-agnostic queries into each source’s native language at query time.query.ai · read 7 Oct 2026
- Read-only access
- The platform describes its data access as read-only, with no DDL risk, no ingestion, and data remaining at its source.query.ai · read 7 Oct 2026
- Security
- Query says its product design follows a “secure by design” principle and that it has an active bug bounty policy.query.ai · read 7 Oct 2026
