Obsidian Stats logoObsidian Stats

Talon CQL

by Caio Lopes
5
4
3
2
1
Score: 35/100
New Plugin
Install Code

Description

This plugin has not been manually reviewed by Obsidian staff. Syntax highlighting for CrowdStrike CQL (LogScale Query Language) in code blocks.

Reviews

No reviews yet.

Stats

stars
downloads
0
forks
0
days
NaN
days
NaN
days
0
total PRs
0
open PRs
0
closed PRs
0
merged PRs
0
total issues
0
open issues
0
closed issues
0
commits

Latest Version

Invalid date

Changelog

See all version on GitHub

README file from

Github

talon-cql

Obsidian plugin — syntax highlighting for CrowdStrike CQL (LogScale Query Language)

Threat hunters who document their work in Obsidian — playbooks, runbooks, DFIR notes — can now get proper syntax highlighting for embedded CQL queries. No equivalent plugin exists in the Obsidian community.

Talon CQL syntax highlighting

Usage

```cql
#event_simpleName=ProcessRollup2
ImageFileName=/powershell\.exe/i
| groupBy([ComputerName, CommandLine], function=count())
| sort(count, order=desc)
```

Also accepts ```logscale as an alias.

Works in both reading mode and editing mode.

Install

Community Plugin

Install from the Obsidian Community Plugins directory, or search for Talon CQL in Settings → Community Plugins.

Manual

  1. Download main.js, manifest.json, styles.css from the latest release
  2. Create .obsidian/plugins/talon-cql/ in your vault
  3. Copy the three files there
  4. Enable in Settings → Community Plugins

What gets highlighted

Token Example
Event fields #event_simpleName, #aid, #cid
Built-in functions groupBy, eval, timeChart, join
Namespaced functions array:contains, math:abs, time:hour
Keywords case, and, or, not, asc, desc
Operators | := =~ != <= >=
Strings "double" 'single'
Regex literals /pattern/i
Numbers 42, 3.14
Comments // and /* */

Query Templates

Ready-to-use hunting queries in templates/:

File Content
process-hunting.cql LOLBins, encoded PowerShell, parent-child chains
network-hunting.cql Beaconing, suspicious ports, geo anomalies
identity-hunting.cql Brute force, off-hours logons, LSASS access

Build

npm install
npm run build   # production → generates main.js
npm run dev     # watch mode for development

References

License

MIT

Sponsors