DC Monolith is a framework and library of reusable CrowdStrike Query Language (CQL) searches for Falcon sensor data in Falcon Next-Gen SIEM / LogScale. It helps practitioners investigate endpoint activity using consistent, editable queries.

Does DC Monolith include threat hunts?

Yes. The library includes a Threat Hunts collection, along with event templates, converted detection queries, and supporting resources. These are saved searches for analysts to run and assess — not automatically enabled alerts.

Can I create my own threat hunts in DC Monolith?

Yes. You can review and edit existing queries, customize conditions for your environment, and save searches for future use. Some queries require supporting helpers to be installed.

Who is DC Monolith designed for?

DC Monolith is built for security analysts, threat hunters, and incident responders who work with CrowdStrike Falcon. It helps teams streamline investigations, standardize queries, and spend less time building searches from scratch.

Does DC Monolith automatically detect and respond to threats?

No. DC Monolith provides reusable queries that security analysts can run, review, and adapt. It supports analyst-led threat hunting rather than automatically detecting or responding to threats.

DC Monolith

DC Monolith gives cyber defenders a structured, repeatable way to hunt for signs of compromise across their environment without starting from scratch.

Ask about DC Monolith

View all services

Structured

A repeatable way to hunt

Start with prepared searches and shared query building blocks instead of rebuilding the groundwork for every investigation.

‍

Efficient

Get to the hunt faster

Spend less time preparing query logic and formatting results, and more time following the evidence.

‍

Scalable

Bring consistency to every hunt

Use common query conventions that make investigations easier to review, adapt, and share across your team.

‍

Expandable

Keep the hunt moving forward

Access reusable templates, detection queries, and supporting resources to expand your threat-hunting capabilities.

‍

Threat hunting shouldn't start with a blank page. Spend less time building searches and more time investigating threats.

HOW IT WORKS

A clear path from query to investigation

Explore

Browse the DC Monolith library to find a template, threat hunt, or detection query that fits the activity you want to investigate.

Prepare

Review and adapt queries to your environment. Run standalone CQL searches or import saved queries and their required helpers into Falcon Next-Gen SIEM / LogScale.

Hunt

Run the search against your CrowdStrike Falcon® telemetry. Follow matching events, add process context where available, and investigate what the results actually mean.