Module for collecting Crowdstrike events.
Fields for Crowdstrike Falcon event and alert data.
Meta data fields for each event that include type and timestamp.
-
crowdstrike.metadata.eventType -
DetectionSummaryEvent, FirewallMatchEvent, IncidentSummaryEvent, RemoteResponseSessionStartEvent, RemoteResponseSessionEndEvent, AuthActivityAuditEvent, or UserActivityAuditEvent
type: keyword
-
crowdstrike.metadata.eventCreationTime -
The time this event occurred on the endpoint in UTC UNIX_MS format.
type: date
-
crowdstrike.metadata.offset -
Offset number that tracks the location of the event in stream. This is used to identify unique detection events.
type: integer
-
crowdstrike.metadata.customerIDString -
Customer identifier
type: keyword
-
crowdstrike.metadata.version -
Schema version
type: keyword
Event data fields for each event and alert.
-
crowdstrike.event.ProcessStartTime -
The process start time in UTC UNIX_MS format.
type: date
-
crowdstrike.event.ProcessEndTime -
The process termination time in UTC UNIX_MS format.
type: date
-
crowdstrike.event.ProcessId -
Process ID related to the detection.
type: integer
-
crowdstrike.event.ParentProcessId -
Parent process ID related to the detection.
type: integer
-
crowdstrike.event.ComputerName -
Name of the computer where the detection occurred.
type: keyword
-
crowdstrike.event.UserName -
User name associated with the detection.
type: keyword
-
crowdstrike.event.DetectName -
Name of the detection.
type: keyword
-
crowdstrike.event.DetectDescription -
Description of the detection.
type: keyword
-
crowdstrike.event.Severity -
Severity score of the detection.
type: integer
-
crowdstrike.event.SeverityName -
Severity score text.
type: keyword
-
crowdstrike.event.FileName -
File name of the associated process for the detection.
type: keyword
-
crowdstrike.event.FilePath -
Path of the executable associated with the detection.
type: keyword
-
crowdstrike.event.CommandLine -
Executable path with command line arguments.
type: keyword
-
crowdstrike.event.SHA1String -
SHA1 sum of the executable associated with the detection.
type: keyword
-
crowdstrike.event.SHA256String -
SHA256 sum of the executable associated with the detection.
type: keyword
-
crowdstrike.event.MD5String -
MD5 sum of the executable associated with the detection.
type: keyword
-
crowdstrike.event.MachineDomain -
Domain for the machine associated with the detection.
type: keyword
-
crowdstrike.event.FalconHostLink -
URL to view the detection in Falcon.
type: keyword
-
crowdstrike.event.SensorId -
Unique ID associated with the Falcon sensor.
type: keyword
-
crowdstrike.event.DetectId -
Unique ID associated with the detection.
type: keyword
-
crowdstrike.event.LocalIP -
IP address of the host associated with the detection.
type: keyword
-
crowdstrike.event.MACAddress -
MAC address of the host associated with the detection.
type: keyword
-
crowdstrike.event.Tactic -
MITRE tactic category of the detection.
type: keyword
-
crowdstrike.event.Technique -
MITRE technique category of the detection.
type: keyword
-
crowdstrike.event.Objective -
Method of detection.
type: keyword
-
crowdstrike.event.PatternDispositionDescription -
Action taken by Falcon.
type: keyword
-
crowdstrike.event.PatternDispositionValue -
Unique ID associated with action taken.
type: integer
-
crowdstrike.event.PatternDispositionFlags -
Flags indicating actions taken.
type: object
-
crowdstrike.event.State -
Whether the incident summary is open and ongoing or closed.
type: keyword
-
crowdstrike.event.IncidentStartTime -
Start time for the incident in UTC UNIX format.
type: date
-
crowdstrike.event.IncidentEndTime -
End time for the incident in UTC UNIX format.
type: date
-
crowdstrike.event.FineScore -
Score for incident.
type: float
-
crowdstrike.event.UserId -
Email address or user ID associated with the event.
type: keyword
-
crowdstrike.event.UserIp -
IP address associated with the user.
type: keyword
-
crowdstrike.event.OperationName -
Event subtype.
type: keyword
-
crowdstrike.event.ServiceName -
Service associated with this event.
type: keyword
-
crowdstrike.event.Success -
Indicator of whether or not this event was successful.
type: boolean
-
crowdstrike.event.UTCTimestamp -
Timestamp associated with this event in UTC UNIX format.
type: date
-
crowdstrike.event.AuditKeyValues -
Fields that were changed in this event.
type: nested
-
crowdstrike.event.ExecutablesWritten -
Detected executables written to disk by a process.
type: nested
-
crowdstrike.event.SessionId -
Session ID of the remote response session.
type: keyword
-
crowdstrike.event.HostnameField -
Host name of the machine for the remote session.
type: keyword
-
crowdstrike.event.StartTimestamp -
Start time for the remote session in UTC UNIX format.
type: date
-
crowdstrike.event.EndTimestamp -
End time for the remote session in UTC UNIX format.
type: date
-
crowdstrike.event.LateralMovement -
Lateral movement field for incident.
type: long
-
crowdstrike.event.ParentImageFileName -
Path to the parent process.
type: keyword
-
crowdstrike.event.ParentCommandLine -
Parent process command line arguments.
type: keyword
-
crowdstrike.event.GrandparentImageFileName -
Path to the grandparent process.
type: keyword
-
crowdstrike.event.GrandparentCommandLine -
Grandparent process command line arguments.
type: keyword
-
crowdstrike.event.IOCType -
CrowdStrike type for indicator of compromise.
type: keyword
-
crowdstrike.event.IOCValue -
CrowdStrike value for indicator of compromise.
type: keyword
-
crowdstrike.event.CustomerId -
Customer identifier.
type: keyword
-
crowdstrike.event.DeviceId -
Device on which the event occurred.
type: keyword
-
crowdstrike.event.Ipv -
Protocol for network request.
type: keyword
-
crowdstrike.event.ConnectionDirection -
Direction for network connection.
type: keyword
-
crowdstrike.event.EventType -
CrowdStrike provided event type.
type: keyword
-
crowdstrike.event.HostName -
Host name of the local machine.
type: keyword
-
crowdstrike.event.ICMPCode -
RFC2780 ICMP Code field.
type: keyword
-
crowdstrike.event.ICMPType -
RFC2780 ICMP Type field.
type: keyword
-
crowdstrike.event.ImageFileName -
File name of the associated process for the detection.
type: keyword
-
crowdstrike.event.PID -
Associated process id for the detection.
type: long
-
crowdstrike.event.LocalAddress -
IP address of local machine.
type: ip
-
crowdstrike.event.LocalPort -
Port of local machine.
type: long
-
crowdstrike.event.RemoteAddress -
IP address of remote machine.
type: ip
-
crowdstrike.event.RemotePort -
Port of remote machine.
type: long
-
crowdstrike.event.RuleAction -
Firewall rule action.
type: keyword
-
crowdstrike.event.RuleDescription -
Firewall rule description.
type: keyword
-
crowdstrike.event.RuleFamilyID -
Firewall rule family id.
type: keyword
-
crowdstrike.event.RuleGroupName -
Firewall rule group name.
type: keyword
-
crowdstrike.event.RuleName -
Firewall rule name.
type: keyword
-
crowdstrike.event.RuleId -
Firewall rule id.
type: keyword
-
crowdstrike.event.MatchCount -
Number of firewall rule matches.
type: long
-
crowdstrike.event.MatchCountSinceLastReport -
Number of firewall rule matches since the last report.
type: long
-
crowdstrike.event.Timestamp -
Firewall rule triggered timestamp.
type: date
-
crowdstrike.event.Flags.Audit -
CrowdStrike audit flag.
type: boolean
-
crowdstrike.event.Flags.Log -
CrowdStrike log flag.
type: boolean
-
crowdstrike.event.Flags.Monitor -
CrowdStrike monitor flag.
type: boolean
-
crowdstrike.event.Protocol -
CrowdStrike provided protocol.
type: keyword
-
crowdstrike.event.NetworkProfile -
CrowdStrike network profile.
type: keyword
-
crowdstrike.event.PolicyName -
CrowdStrike policy name.
type: keyword
-
crowdstrike.event.PolicyID -
CrowdStrike policy id.
type: keyword
-
crowdstrike.event.Status -
CrowdStrike status.
type: keyword
-
crowdstrike.event.TreeID -
CrowdStrike tree id.
type: keyword
-
crowdstrike.event.Commands -
Commands run in a remote session.
type: keyword