A detection query is a search rule or analytic expression used to find suspicious activity in security telemetry. It can be written for a SIEM, XDR, EDR, or log platform, and it usually filters, groups, and compares events to surface patterns that may indicate compromise. Common examples include searches for rare parent-child process chains, unusual outbound connections, impossible travel, or command-and-control beacons.
Detection queries matter because defenders depend on them to turn raw logs into actionable alerts and hunt results. If the query assumes a specific data format, it may miss activity even when the event is present. For example, network telemetry may store an address in a different representation than the analyst expects, so normalization and careful field handling become critical. Attackers benefit from brittle queries because missed matches create blind spots, while defenders improve coverage by testing rules against real telemetry, variant encodings, and edge cases.