r/crowdstrike•
CyberHaki

Creating CS Detections from Queries.

Feature Question

We normally create scheduled searches that emails us if there is a detected event. But we were wondering if it's possible to turn it into a detection instead of sending an email?

This would also make it easier for us to ingest it in Splunk if we can convert a query into a real time detection.

Any advise is appreciated on this one.

Posted May 12, 2026, 2:36 PM UTC

64
Loading comments…