ASimRegistryEventLogs_CL

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

---

Attribute	Value
Ingestion API Supported	✓ Yes

Contents

• Schema
• Schema References
• Solutions
• Connectors
• Parsers

Schema (60 columns)

Source: KQL validation test schema

Column Name	Type
ActingProcessGuid	string
ActingProcessId	string
ActingProcessName	string
ActorScope	string
ActorScopeId	string
ActorSessionId	string
ActorUserId	string
ActorUserIdType	string
ActorUsername	string
ActorUsernameType	string
AdditionalFields	dynamic
DvcAction	string
DvcDescription	string
DvcDomain	string
DvcDomainType	string
DvcFQDN	string
DvcHostname	string
DvcId	string
DvcIdType	string
DvcInterface	string
DvcIpAddr	string
DvcMacAddr	string
DvcOriginalAction	string
DvcOs	string
DvcOsVersion	string
DvcScope	string
DvcScopeId	string
DvcZone	string
EventCount	int
EventEndTime	datetime
EventMessage	string
EventOriginalResultDetails	string
EventOriginalSeverity	string
EventOriginalSubType	string
EventOriginalType	string
EventOriginalUid	string
EventOwner	string
EventProduct	string
EventProductVersion	string
EventReportUrl	string
EventResult	string
EventResultDetails	string
EventSchemaVersion	string
EventSeverity	string
EventStartTime	datetime
EventSubType	string
EventType	string
EventVendor	string
ParentProcessGuid	string
ParentProcessId	string
ParentProcessName	string
RegistryKey	string
RegistryPreviousKey	string
RegistryPreviousValue	string
RegistryPreviousValueData	string
RegistryPreviousValueType	string
RegistryValue	string
RegistryValueData	string
RegistryValueType	string
TimeGenerated	datetime

Schema References

Official Microsoft Learn documentation for field/column information:

• Data Source Schema Reference

Solutions (1)

This table is used by the following solutions:

• CrowdStrike Falcon Endpoint Protection

Connectors (1)

This table is ingested by the following connectors:

Selection Criteria: EventProduct == "Falcon Data Replicator"
EventVendor == "CrowdStrike"

Connector
CrowdStrike Falcon Data Replicator (CrowdStrike Managed AWS-S3)

---

Parsers Using This Table (1)

Other Parsers (1) — Selection Criteria: EventProduct == "Falcon Data Replicator"
EventVendor == "CrowdStrike"

Parser	Solution
CrowdStrikeReplicatorV2	CrowdStrike Falcon Endpoint Protection

Selection Criteria Summary (1 criteria, 2 total references)

References by type: 1 connectors, 0 content items, 0 ASIM parsers, 1 other parsers.

Selection Criteria	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
EventProduct == "Falcon Data Replicator" EventVendor == "CrowdStrike"	1	-	-	1	2
Total	1	0	0	1	2

EventProduct / EventVendor

EventProduct	EventVendor	Connectors	Content Items	ASIM Parsers	Other Parsers	Total
Falcon Data Replicator	CrowdStrike	1	-	-	1	2

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index