Obsidian Stats logoObsidian Stats

Talon CQL

by Caio Lopes
5
4
3
2
1
Score: 51/100
Install Code

Description

Obsidian plugin — CQL syntax highlighting for CrowdStrike LogScale

Reviews

No reviews yet.

Stats

4
stars
121
downloads
0
forks
108
days
50
days
50
days
0
total PRs
0
open PRs
0
closed PRs
0
merged PRs
0
total issues
0
open issues
0
closed issues
9
commits

Latest Version

0.2.0
2 months ago

Changelog

See all version on GitHub

README file from

Github

talon-cql

Obsidian plugin — syntax highlighting for CrowdStrike CQL (LogScale Query Language)

Threat hunters who document their work in Obsidian — playbooks, runbooks, DFIR notes — can now get proper syntax highlighting for embedded CQL queries. No equivalent plugin exists in the Obsidian community.

Talon CQL syntax highlighting

Usage

```cql
#event_simpleName=ProcessRollup2
ImageFileName=/powershell\.exe/i
| groupBy([ComputerName, CommandLine], function=count())
| sort(count, order=desc)
```

Also accepts ```logscale as an alias.

Blocks highlight through Obsidian's native code-block pipeline in reading mode, Live Preview, and source mode: colorization stays active while you edit, the language flair copies the block ("Copied to your clipboard"), and colors come from your theme's code variables.

Install

Community Plugin

Install from the Obsidian Community Plugins directory, or search for Talon CQL in Settings → Community Plugins.

Manual

  1. Download main.js, manifest.json, styles.css from the latest release
  2. Create .obsidian/plugins/talon-cql/ in your vault
  3. Copy the three files there
  4. Enable in Settings → Community Plugins

What gets highlighted

Token Example
Event fields #event_simpleName, #aid, #cid
Built-in functions groupBy, eval, timeChart, join
Namespaced functions array:contains, math:abs, time:hour
Keywords case, and, or, not, asc, desc
Operators | := =~ != <= >=
Strings "double" 'single'
Regex literals /pattern/i
Numbers 42, 3.14
Comments // and /* */

Query Templates

Ready-to-use hunting queries in templates/:

File Content
process-hunting.cql LOLBins, encoded PowerShell, parent-child chains
network-hunting.cql Beaconing, suspicious ports, geo anomalies
identity-hunting.cql Brute force, off-hours logons, LSASS access

Build

npm install
npm run build   # production → generates main.js
npm run dev     # watch mode for development

References

License

MIT

Sponsors