ASIM Authentication parser for CrowdStrike Falcon Endpoint Protection
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
Parser Information
| Property | Value |
|---|---|
| Parser Name | ASimAuthenticationCrowdStrikeFalconHost |
| Built-in Parser | _ASim_Authentication_CrowdStrikeFalconHost |
| Schema | Authentication |
| Schema Version | 0.1.3 |
| Parser Type | 🔌 Source (product-specific) |
| Product | CrowdStrike Falcon Endpoint Protection |
| Parser Version | 0.2.0 (version history) |
| Last Updated | Jan 16, 2026 |
| Unifying Parser | ASimAuthentication |
| Source File | Parsers\ASimAuthentication\Parsers\ASimAuthenticationCrowdStrikeFalconHost.yaml |
Description
This ASIM parser supports normalizing CrowdStrike Falcon Endpoint Protection logs to the ASIM Authentication normalized schema. These events are captured through CrowdStrike Falcon Endpoint Protection data connector which allows you to easily connect your CrowdStrike Falcon Event Stream with Microsoft Sentinel.
Source Tables
This parser reads from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
CommonSecurityLog |
DeviceEventClassID in "twoFactorAuthenticate,userAuthenticate"DeviceProduct == "FalconHost"DeviceVendor == "CrowdStrike" |
✓ | ✓ | ✓ |
Parameters
| Name | Type | Default |
|---|---|---|
disabled |
bool | False |
Associated Connectors
The following connectors provide data for this parser:
Solutions: Common Event Format, CrowdStrike Falcon Endpoint Protection (legacy connector), VirtualMetric DataStream
References
- ASIM Authentication Schema
- ASIM
- [CrowdStrike Falcon Endpoint Protection Documentation](https://falcon.us-2.crowdstrike.com/documentation/page/d88d9ed6/streaming-api-event-dictionary https://falcon.us-2.crowdstrike.com/documentation/page/eb1587d1/siem-connector#mc98af8f)
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊