CrowdStrike Falcon event stream

CrowdStrike Falcon event stream. Falcon event-stream objects carry a metadata envelope and an event-specific payload.

Source and collection

Vendor API or configured event stream, with tenant permissions and retention controls.

Use the documented API scope and subscription; preserve event IDs, metadata version and pagination/offset state.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — line 1

One complete record selected; values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: 70003e22cee579f1989b902eb39a9a4aa71cb92abed93a462fc103b4428a4509

{"metadata":{"customerIDString":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","offset":1234567890,"eventType":"AutomatedLeadSummaryEvent","eventCreationTime":1778476402000,"version":"1.0"},"event":{"LeadId":"cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc","Name":"host-1.example.local at 2026-05-11T05:11:47Z","SignalStartTimestamp":1778476307,"SignalEndTimestamp":1778476400,"SignalUpdatedTimestamp":1778476400,"Score":21,"ThreatgraphIndicators":[{"IndicatorId":"ind:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb:1778476306425098436-6004-19626768","SignalAssociationTimestamp":1778476307,"PatternId":6004,"PatternDisposition":0,"ProcessId":"1778476306425098436","HostId":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","Hostname":"host-1.example.local","TemplateInstanceId":0,"Description":"A command intended to perform reconnaissance has executed under a web service.","DisplayName":"ReconUnderWebService"}],"MitreAttack":[{"PatternID":6004},{"Tactic":"Execution","TacticID":"TA0002","Technique":"Exploitation for Client Execution","TechniqueID":"T1203","PatternID":6017}],"LeadType":"simple","CompositeId":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:automated-lead:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc","FalconHostLink":"https://falcon.us-2.crowdstrike.com/automated-leads/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:automated-lead:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc?_cid=g04000aaaaaaaaaaaaaaaaaaaaaaaab"}}

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`metadata.customerIDString`	str
`metadata.offset`	int
`metadata.eventType`	str
`metadata.eventCreationTime`	int
`metadata.version`	str
`event.LeadId`	str
`event.Name`	str
`event.SignalStartTimestamp`	int
`event.SignalEndTimestamp`	int
`event.SignalUpdatedTimestamp`	int
`event.Score`	int
`event.ThreatgraphIndicators`	array
`event.ThreatgraphIndicators[0].IndicatorId`	str
`event.ThreatgraphIndicators[0].SignalAssociationTimestamp`	int
`event.ThreatgraphIndicators[0].PatternId`	int
`event.ThreatgraphIndicators[0].PatternDisposition`	int
`event.ThreatgraphIndicators[0].ProcessId`	str
`event.ThreatgraphIndicators[0].HostId`	str
`event.ThreatgraphIndicators[0].Hostname`	str
`event.ThreatgraphIndicators[0].TemplateInstanceId`	int
`event.ThreatgraphIndicators[0].Description`	str
`event.ThreatgraphIndicators[0].DisplayName`	str
`event.MitreAttack`	array
`event.MitreAttack[0].PatternID`	int
`event.LeadType`	str
`event.CompositeId`	str
`event.FalconHostLink`	str

id / event ID: Vendor-scoped identity; retain tenant context.
status: Workflow status is not evidence of maliciousness.
metadata: Stream version and cursor information where present.

Investigation uses

Triage the stated detection with source telemetry and analyst context.
Track duplicate delivery, status changes and last-update timestamps without overwriting original evidence.

Validation boundaries

This is an Event Streams example, not a Falcon Data Replicator raw sensor event. Event types have different payload schemas.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Microsoft Defender for Endpoint alerts API

Ecosystem connections

References

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.