Data Source: CrowdStrike Falcon Stream Alert

Created: 2025-07-01

Last Updated: 2026-10-14

ID: 52b38751-b0db-4965-a800-ebaabd1fd7d5

Author: Bhavin Patel, Bryan Pluta, Splunk

Description

Logs of CrowdStrike Falcon Stream Alerts

Details

Property	Value
Source	`CrowdStrike:Event:Streams`
Sourcetype	`CrowdStrike:Event:Streams:JSON`
Separator	event.DetectName

Name ▲▼	Technique ▲▼	Type ▲▼
CrowdStrike Falcon Stream Alerts	None	Anomaly

Supported Apps

Splunk Add-on for CrowdStrike FDR (version 3.2.0)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">event.AgentId</span>
  
  <span class="pill kill-chain">event.AggregateId</span>
  
  <span class="pill kill-chain">event.Author</span>
  
  <span class="pill kill-chain">event.CloudIndicator</span>
  
  <span class="pill kill-chain">event.CommandLine</span>
  
  <span class="pill kill-chain">event.CompositeId</span>
  
  <span class="pill kill-chain">event.DataDomains</span>
  
  <span class="pill kill-chain">event.Description</span>
  
  <span class="pill kill-chain">event.EndTimeEpoch</span>
  
  <span class="pill kill-chain">event.FalconHostLink</span>
  
  <span class="pill kill-chain">event.FileName</span>
  
  <span class="pill kill-chain">event.FilePath</span>
  
  <span class="pill kill-chain">event.FilesAccessed{}.FileName</span>
  
  <span class="pill kill-chain">event.FilesAccessed{}.FilePath</span>
  
  <span class="pill kill-chain">event.FilesAccessed{}.Timestamp</span>
  
  <span class="pill kill-chain">event.GrandParentCommandLine</span>
  
  <span class="pill kill-chain">event.GrandParentImageFileName</span>
  
  <span class="pill kill-chain">event.GrandParentImageFilePath</span>
  
  <span class="pill kill-chain">event.HostGroups</span>
  
  <span class="pill kill-chain">event.Hostname</span>
  
  <span class="pill kill-chain">event.HostNames</span>
  
  <span class="pill kill-chain">event.IPv4Addresses</span>
  
  <span class="pill kill-chain">event.LocalIP</span>
  
  <span class="pill kill-chain">event.LocalIPv6</span>
  
  <span class="pill kill-chain">event.LogonDomain</span>
  
  <span class="pill kill-chain">event.MACAddress</span>
  
  <span class="pill kill-chain">event.MD5Hashes</span>
  
  <span class="pill kill-chain">event.MD5String</span>
  
  <span class="pill kill-chain">event.MitreAttack{}.PatternID</span>
  
  <span class="pill kill-chain">event.MitreAttack{}.Tactic</span>
  
  <span class="pill kill-chain">event.MitreAttack{}.TacticID</span>
  
  <span class="pill kill-chain">event.MitreAttack{}.Technique</span>
  
  <span class="pill kill-chain">event.MitreAttack{}.TechniqueID</span>
  
  <span class="pill kill-chain">event.Name</span>
  
  <span class="pill kill-chain">event.Objective</span>
  
  <span class="pill kill-chain">event.ParentCommandLine</span>
  
  <span class="pill kill-chain">event.ParentImageFileName</span>
  
  <span class="pill kill-chain">event.ParentImageFilePath</span>
  
  <span class="pill kill-chain">event.ParentProcessId</span>
  
  <span class="pill kill-chain">event.PatternDispositionDescription</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.BlockingUnsupportedOrDisabled</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.BootupSafeguardEnabled</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.ContainmentFileSystem</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.CriticalProcessDisabled</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.Detect</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.FsOperationBlocked</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.HandleOperationDowngraded</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.InddetMask</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.Indicator</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.KillActionFailed</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.KillParent</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.KillProcess</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.KillSubProcess</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.OperationBlocked</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.PolicyDisabled</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.ProcessBlocked</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.QuarantineFile</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.QuarantineMachine</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.RegistryOperationBlocked</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.Rooting</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.SensorOnly</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.SuspendParent</span>
  
  <span class="pill kill-chain">event.PatternDispositionFlags.SuspendProcess</span>
  
  <span class="pill kill-chain">event.PatternDispositionValue</span>
  
  <span class="pill kill-chain">event.PatternId</span>
  
  <span class="pill kill-chain">event.PlatformId</span>
  
  <span class="pill kill-chain">event.PlatformName</span>
  
  <span class="pill kill-chain">event.ProcessEndTime</span>
  
  <span class="pill kill-chain">event.ProcessId</span>
  
  <span class="pill kill-chain">event.ProcessStartTime</span>
  
  <span class="pill kill-chain">event.RiskScore</span>
  
  <span class="pill kill-chain">event.ScheduledSearchExecutionId</span>
  
  <span class="pill kill-chain">event.ScheduledSearchId</span>
  
  <span class="pill kill-chain">event.ScheduledSearchUserId</span>
  
  <span class="pill kill-chain">event.ScheduledSearchUserUUID</span>
  
  <span class="pill kill-chain">event.SensorIds</span>
  
  <span class="pill kill-chain">event.Severity</span>
  
  <span class="pill kill-chain">event.SeverityName</span>
  
  <span class="pill kill-chain">event.SHA1String</span>
  
  <span class="pill kill-chain">event.SHA256Hashes</span>
  
  <span class="pill kill-chain">event.SHA256String</span>
  
  <span class="pill kill-chain">event.SourceProducts</span>
  
  <span class="pill kill-chain">event.SourceVendors</span>
  
  <span class="pill kill-chain">event.StartTimeEpoch</span>
  
  <span class="pill kill-chain">event.Tactic</span>
  
  <span class="pill kill-chain">event.Tags</span>
  
  <span class="pill kill-chain">event.Technique</span>
  
  <span class="pill kill-chain">event.Type</span>
  
  <span class="pill kill-chain">event.UserName</span>
  
  <span class="pill kill-chain">event.XdrType</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">metadata.customerIDString</span>
  
  <span class="pill kill-chain">metadata.eventCreationTime</span>
  
  <span class="pill kill-chain">metadata.eventType</span>
  
  <span class="pill kill-chain">metadata.offset</span>
  
  <span class="pill kill-chain">metadata.version</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">ta_data.App_id</span>
  
  <span class="pill kill-chain">ta_data.Cloud_environment</span>
  
  <span class="pill kill-chain">ta_data.Event_types</span>
  
  <span class="pill kill-chain">ta_data.Feed_id</span>
  
  <span class="pill kill-chain">ta_data.Initial_start</span>
  
  <span class="pill kill-chain">ta_data.Input</span>
  
  <span class="pill kill-chain">ta_data.Multiple_feeds</span>
  
  <span class="pill kill-chain">ta_data.TA_version</span>
  
  <span class="pill kill-chain">timestamp</span>
  
</div>

Example Log

1{"metadata": {"customerIDString": "3061c7ff3b634e22b38274d4b586558e", "offset": 15832103, "eventType": "XdrDetectionSummaryEvent", "eventCreationTime": 1769785678000, "version": "1.0"}, "event": {"Name": "Incident rule", "Description": "Making incidents", "PatternId": 100010, "StartTimeEpoch": 1769702707146, "EndTimeEpoch": 1769785616007, "Severity": 30, "SourceProducts": "Falcon", "SourceVendors": "CrowdStrike", "DataDomains": "Endpoint", "Author": "CorrelationRule", "XdrType": "xdr-scheduled-search", "ScheduledSearchId": "bb1f2a9e0fd34c2794f4e84ae6bf904f", "ScheduledSearchExecutionId": "2463f62488fe4d3a953507f83514eaca", "ScheduledSearchUserUUID": "c59a4ab7-e679-4c9c-ab20-05730ba369e0", "ScheduledSearchUserId": "phantomlab@splunk.com", "IPv4Addresses": "10.1.17.4", "HostNames": "CROWDFAL2", "SHA256Hashes": "df8085fb7d979c644a751804ed6bd3b74b26ce682291b5e5ede4c76eca599e7e", "MD5Hashes": "ed5fc58ec99a058ce9b7bb1ee3a96a8e", "SensorIds": "9a58cd4397bb4a2abadf0189e36ab0e7", "CompositeId": "3061c7ff3b634e22b38274d4b586558e:ind:3061c7ff3b634e22b38274d4b586558e:xdr|2463f62488fe4d3a953507f83514eaca-ffb6e76c9f2e42b4a8c1b997091b90e0"}, "ta_data": {"Feed_id": "0", "Multiple_feeds": "False", "Cloud_environment": "us_commercial", "TA_version": "3.6.5", "Input": "crwd_events", "App_id": "s2_pl", "Event_types": "['All']", "Initial_start": "historic"}}

Required Output Fields

dest
user
process
file_name
Name

Source: GitHub | Version: 3

Data Source: CrowdStrike Falcon Stream Alert

Description

Details

Related Detections

Supported Apps

Event Fields

Example Log

Required Output Fields