Audit Event ASIM parser for CrowdStrike Falcon Endpoint Protection
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Parser Information
| Property | Value |
|---|---|
| Parser Name | ASimAuditEventCrowdStrikeFalconHost |
| Built-in Parser | _ASim_AuditEvent_CrowdStrikeFalconHost |
| Schema | AuditEvent |
| Schema Version | 0.1 |
| Parser Type | 🔌 Source (product-specific) |
| Product | CrowdStrike Falcon Endpoint Protection |
| Parser Version | 0.1.0 (version history) |
| Last Updated | Oct 30 2023 |
| Unifying Parser | ASimAuditEvent |
| Source File | Parsers\ASimAuditEvent\Parsers\ASimAuditEventCrowdStrikeFalconHost.yaml |
Description
This ASIM parser supports normalizing CrowdStrike Falcon Endpoint Protection logs to the ASIM Audit Event normalized schema. These events are captured through CrowdStrike Falcon Endpoint Protection data connector which allows you to easily connect your CrowdStrike Falcon Event Stream with Microsoft Sentinel.
Source Tables
This parser reads from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
CommonSecurityLog |
DeviceEventClassID == "UserActivityAuditEvent"DeviceProduct == "FalconHost"DeviceVendor == "CrowdStrike" |
✓ | ✓ | ✓ |
Parameters
| Name | Type | Default |
|---|---|---|
disabled |
bool | False |
Associated Connectors
The following connectors provide data for this parser:
Solutions: Common Event Format, CrowdStrike Falcon Endpoint Protection (legacy connector), VirtualMetric DataStream
References
- ASIM Audit Event Schema
- ASIM
- [CrowdStrike Falcon Endpoint Protection Documentation](https://falcon.us-2.crowdstrike.com/documentation/page/d88d9ed6/streaming-api-event-dictionary https://falcon.us-2.crowdstrike.com/documentation/page/eb1587d1/siem-connector#mc98af8f)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊