CrowdStrike Falcon events for investigators
The Falcon sensor reports what happens on a host as events, each named in event_simpleName:
ProcessRollup2 for a process that ran, NetworkConnectIP4 for an outbound connection,
DnsRequest for a name lookup, UserLogon and UserLogonFailed2 for sign-ins. Every event
carries the sensor's aid and the customer's cid; the event type decides which other fields are there.
You meet these names in Falcon's event search, in Falcon Data Replicator exports, and in a SIEM fed from either.
CrowdStrike's own event dictionary sits behind the Falcon console login. These pages are built from public sources that
agree with one another — CrowdStrike's own published queries, Panther's Falcon Data Replicator schemas and Splunk's data
source for ProcessRollup2 — and a field is listed for an event only when those sources document it. Each page
says what the event records, which fields carry the signal and how to query it.
Detections are not sensor events. A detection summary comes from the streaming API and is identified by
ExternalApiType — Event_DetectionSummaryEvent, with the sensor in AgentIdString. In
Falcon's LogScale data it often has no event_simpleName at all, which is why
CrowdStrike's own detection query takes records without one and
filters on ExternalApiType.
Events explained
- ProcessRollup2
One process start on a host — the executable in ImageFileName, its CommandLine, the parent process and the user's SID — with TargetProcessId as the ID that ties the process to everything it did afterwards.
- UserLogon
One successful sign-in on a host — who logged on, how (LogonType), from which address for remote logons, whether the account is an administrator, and when its password was last set.
- NetworkConnectIP4
One IPv4 connection attempt by a process on a host — local and remote address and port, protocol and direction — with ContextProcessId naming the process that made it.
- DnsRequest
One DNS lookup attempted on a host — the name in DomainName, the record type, the IPv4 answers, and in ContextProcessId the process that asked, so every domain can be tied to a program.
- NetworkListenIP4
A program on a host started listening for incoming connections — the local address and port, the protocol, and in ContextProcessId the process that opened the socket.
- UserLogonFailed2
One failed sign-in on a Windows host as the Falcon sensor saw it — the account tried, the logon type, the reason as a decimal NTSTATUS code in SubStatus, and for network attempts the address it came from.
- UserLogoff
The end of a logon session on a host — which account, which logon type, when the session started and ended — so a UserLogon can be turned into a session with a length.
- UserIdentity
A description of an account that logged on to a host — its name, SID, domain, logon server and authentication package — sent about once per account, mainly useful for turning the UserSid in other events into a name.
- SyntheticProcessRollup2
A process record the Falcon sensor writes outside the normal process start — its SyntheticPR2Flags value says which case — with the same core fields as ProcessRollup2, so a process hunt that skips it can miss a process.
Every event_simpleName in CrowdStrike's queries
The 137 event types that appear in CrowdStrike's own published queries (logscale-community-content), by how many files use each. Linked ones have a page; the number of documented fields is shown where the public sources document them.
- ProcessRollup2 127 files · 66 fields
- UserLogon 35 files · 19 fields
- NetworkConnectIP4 28 files · 11 fields
- DnsRequest 27 files · 9 fields
- OsVersionInfo 23 files · 3 fields
- CommandHistory 18 files
- ScriptControl 16 files
- SensorHeartbeat 9 files
- NetworkListenIP4 8 files · 9 fields
- UserLogonFailed2 8 files · 5 fields
- AgentOnline 7 files
- Event_IdpDetectionSummaryEvent 5 files · 9 fields
- NetworkReceiveAcceptIP4 5 files
- UserLogoff 5 files · 16 fields
- PeFileWritten 4 files
- ScheduledTaskRegistered 4 files · 5 fields
- UserIdentity 4 files · 20 fields
- UserLogonFailed 4 files
- ActiveDirectoryAccount 3 files
- ActiveDirectoryAccountPasswordUpdate 3 files
- ConfigStateUpdate 3 files
- HttpRequestDetect 3 files
- InstalledApplication 3 files
- NetworkConnectIP6 3 files
- ResourceUtilization 3 files
- SyntheticProcessRollup2 3 files · 24 fields
- SystemCapacity 3 files
- TlsClientHello 3 files
- ZipFileWritten 3 files
- ActiveDirectoryAccountCreated 2 files
- ActiveDirectoryAccountLocked 2 files
- ActiveDirectoryAuthenticationFailure 2 files
- DCSyncAttempted 2 files
- EndOfProcess 2 files
- Event_DataProtectionDetectionSummaryEvent 2 files
- Event_EppDetectionSummaryEvent 2 files
- FirewallDeleteRuleIP4 2 files
- FirewallRuleIP4Matched 2 files
- FirewallSetRule 2 files
- FirewallSetRuleIP4 2 files
- HttpRequest 2 files
- InstalledBrowserExtension 2 files · 4 fields
- NetworkCloseIP4 2 files
- NetworkConnectIP4Blocked 2 files
- NetworkConnectIP4DetectInfo 2 files
- NewScriptWritten 2 files
- PackedExecutableWritten 2 files
- PeVersionInfo 2 files
- ProcessExecOnRDPFile 2 files
- ProcessExecOnSMBFile 2 files
- PromiscuousBindIP4 2 files
- RawBindIP4 2 files
- ReflectiveDotnetModuleLoad 2 files · 3 fields
- RemediationActionKillIP4Connection 2 files
- RemoteBruteForceDetectInfo 2 files
- ServiceStarted 2 files · 3 fields
- SmbServerShareOpenedEtw 2 files
- SsoApplicationAccessFailure 2 files
- SsoUserLogonFailure 2 files
- SuspiciousDnsRequest 2 files
- UserAccountCreated 2 files
- WmiCreateProcess 2 files
- ActiveDirectoryAuditUserModified 1 file
- AcUninstallConfirmation 1 file
- AsepKeyUpdate 1 file
- AsepValueUpdate 1 file
- AssociateTreeIdWithRoot 1 file
- BrowserInjectedThread 1 file
- ChannelVersionRequired 1 file
- CriticalEnvironmentVariableChanged 1 file
- CriticalFileModified 1 file
- CurrentSystemTags 1 file
- DataEgress 1 file
- DcUsbDeviceConnected 1 file
- DcUsbDeviceDisconnected 1 file
- DcUsbDevicePolicyViolation 1 file
- DcUsbInterfaceDescriptor 1 file
- DetectAnalysis 1 file
- DetectionExcluded 1 file
- DLLInjections 1 file
- DriverLoad 1 file
- ELFFileWritten 1 file
- Event_RemoteResponseSessionStartEvent 1 file
- Event_UserActivityAuditEvent 1 file
- ExecutableDeleted 1 file
- FalconProcessHandleOpDetectInfo 1 file
- FileDeleteInfo 1 file
- FileDetectInfo 1 file
- FileIntegrityMonitorRuleMatched 1 file
- FirmwareImageAnalyzed 1 file
- FirmwareImageCheck 1 file
- HostnameChanged 1 file
- ImageHash 1 file
- ImgExtensionFileWritten 1 file
- InjectedThread 1 file
- InjectedThreadFromUnsignedModule 1 file
- InstanceMetadata 1 file
- IsoExtensionFileWritten 1 file
- JavaInjectedThread 1 file
- KillThreadStatus 1 file
- LocalIpAddressIP4 1 file
- LocalIpAddressIP6 1 file
- MachOFileWritten 1 file
- ModuleBlockedEventWithPatternId 1 file
- NetworkOutboundPortScanDetectInfo 1 file
- NewExecutableRenamed 1 file
- NewExecutableWritten 1 file
- ObPost 1 file
- PodInfo 1 file
- ProcessBlocked 1 file
- Ransomware 1 file
- RarFileWritten 1 file
- RegGenericValueUpdate 1 file
- RegistryOperationBlocked 1 file
- RegistryOperationDetectInfo 1 file
- RemediationAction 1 file
- RemediationMonitor 1 file
- ScheduledTask 1 file
- ScheduledTaskModified 1 file
- Script 1 file
- ScriptControlBlocked 1 file
- ScriptControlDetectInfo 1 file
- ScriptControlScanInfo 1 file
- SevenZipFileWritten 1 file
- SuspiciousCreateSymbolicLink 1 file
- SuspiciousPeFileWritten 1 file
- SuspiciousRegAsepUpdate 1 file
- SuspiciousUserRemoteAPCAttempt 1 file
- TerminateProcess 1 file
- TokenImpersonated 1 file
- UserAccountAddedToGroup 1 file
- UserAccountDeleted 1 file
- WebScriptFileWritten 1 file
- ZerologonExploitAttempt 1 file
- ZeroTrustHostAssessment 1 file
- GroupIdentity Panther schema · 6 fields
- ProcessRollup2Stats Panther schema · 9 fields
Refreshed weekly from CrowdStrike's repository and Panther's schema documentation. The export format itself: CrowdStrike Falcon log fields.
Have a whole Falcon export to read?
The free browser analyzer reads Falcon Data Replicator and event-stream exports and flags suspicious command lines, LSASS access, logon failures, reverse-shell ports and Falcon's own detections, with event names linked to their pages here. Nothing is uploaded.
Investigating something right now? LogTriage checks every address in the file against threat intelligence and writes the incident report: 10 analyses a month free. The incident pack adds the in-depth AI analysis and files up to 100 MB: 25 analyses for $19, one payment, no subscription. Pricing