Query

Name: Query
Brand: Query

Federated Search For Security Teams

Est 2018|Valuation $62.1M|Raised $19.7M|11 Ref Customers

LinkedIn 6K|Web traffic 3K|FTEs 45|HQ Atlanta, Georgia, US

MarketsSecurity Orchestration, Automation, and Response (SOAR)

01Competitive Landscape

Narrative analysis

Where Query appears to provide specific capabilities: - Security-specific federation with runtime normalization to an OCSF lens is emphasized in vendor documentation. - The Splunk augmentation story targets expanding Splunk visibility without ingesting external data into Splunk indexes. - Partnership messaging targets organizations considering SIEM replacement or modernization. Where alternatives may be stronger: - Splunk Federated Search: for requirements limited to searching remote Splunk datasets, Splunk's native capabilities can reduce third-party operational complexity. - Cribl: for organizations focused on routing, processing, and retention control with clearer packaging and broader adoption, Cribl can be more directly controllable. Market adoption signals should be treated cautiously: some platform engagement indicators exist for this vendor, but these metrics are not supported by independent reviews in the sources reviewed.

	Query (query.ai)	Splunk Federated Search	Cribl (Stream/Search ecosystem)
Starting Price	Listed on a marketplace as an annual contract with a relatively high entry price (tens of thousands per year); custom private offers available	Pricing not transparently shown in Splunk docs; typically bundled/entitlement-based with Splunk Cloud features	Public packaging includes a free tier with limited volume allowances, then paid tiers based on volume/credits and feature tiers
Best For	SecOps teams needing cross-tool investigations without centralizing all data; SIEM cost control via searching data in place	Existing Splunk customers needing to query remote Splunk datasets and object storage within Splunk constraints	Teams building flexible ingestion/routing/pipelines and search over data routed to destinations; used to optimize observability/security data flows
Key Strength	Broad security-tool connector story and OCSF-based normalization at query time; Splunk app to extend Splunk without ingestion	Deep integration into Splunk workflows and SPL; supports searching remote Splunk deployments and supported object stores	Strong data engineering and pipeline control; flexible routing and processing; broader adoption and ecosystem
Key Weakness	Limited independent review footprint; federation performance constrained by APIs; relatively high entry price for smaller organizations	SPL limitations in federated modes; tied to Splunk architecture and entitlements; federation scope depends on provider types	Often involves moving or routing data (not purely leave-in-place); ROI depends on pipeline design and operational maturity

01Competitive Landscape

Narrative analysis

Where Query appears to provide specific capabilities:

Security-specific federation with runtime normalization to an OCSF lens is emphasized in vendor documentation.
The Splunk augmentation story targets expanding Splunk visibility without ingesting external data into Splunk indexes.
Partnership messaging targets organizations considering SIEM replacement or modernization.

Where alternatives may be stronger:

Splunk Federated Search: for requirements limited to searching remote Splunk datasets, Splunk's native capabilities can reduce third-party operational complexity.
Cribl: for organizations focused on routing, processing, and retention control with clearer packaging and broader adoption, Cribl can be more directly controllable.

Market adoption signals should be treated cautiously: some platform engagement indicators exist for this vendor, but these metrics are not supported by independent reviews in the sources reviewed.

	Query (query.ai)	Splunk Federated Search	Cribl (Stream/Search ecosystem)
Starting Price	Listed on a marketplace as an annual contract with a relatively high entry price (tens of thousands per year); custom private offers available	Pricing not transparently shown in Splunk docs; typically bundled/entitlement-based with Splunk Cloud features	Public packaging includes a free tier with limited volume allowances, then paid tiers based on volume/credits and feature tiers
Best For	SecOps teams needing cross-tool investigations without centralizing all data; SIEM cost control via searching data in place	Existing Splunk customers needing to query remote Splunk datasets and object storage within Splunk constraints	Teams building flexible ingestion/routing/pipelines and search over data routed to destinations; used to optimize observability/security data flows
Key Strength	Broad security-tool connector story and OCSF-based normalization at query time; Splunk app to extend Splunk without ingestion	Deep integration into Splunk workflows and SPL; supports searching remote Splunk deployments and supported object stores	Strong data engineering and pipeline control; flexible routing and processing; broader adoption and ecosystem
Key Weakness	Limited independent review footprint; federation performance constrained by APIs; relatively high entry price for smaller organizations	SPL limitations in federated modes; tied to Splunk architecture and entitlements; federation scope depends on provider types	Often involves moving or routing data (not purely leave-in-place); ROI depends on pipeline design and operational maturity