MELTr
Home Vendors Search Download
Login
Vendors / CrowdStrike / Falcon Platform / CrowdStrike logged-reference-request
CrowdStrike logo

Event type

CrowdStrike logged-reference-request

logged-reference-request; sample-backed independent native Event Streams JSON replica. Registry identities and fresh UTC clock; not a sequenced stream.

JSON 68 fields Generator

crowdstrike audit
Preview Sample View Schema
CLI Install
meltr templates install crowdstrike

Overview

What this event covers

Narrow documented reference profile. Uses schema-standard registry fields (user.email, device.ip_address/hostname) plus generated CrowdStrike IDs (CID, client/detection/group IDs). Works with the default entity sample.

When generated

  • ›logged

Security relevance

Informational

Frequency notes

Local test rate only. Independent records; no lifecycle simulation.

Resources

Docs and tools

Full reference event reference

Generation

Configuration

Base frequency
3600 events/hour
Business hours
1.0x
Night hours
1.0x
Weekend
1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

metadata.customerIDString
String Optional

`cid` (random_string 32 hex)

Source: `cid` (random_string 32 hex)

Example aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
metadata.offset
Integer Optional

`fake.pyint(min_value=1,max_value=2147483647)`

Source: `fake.pyint(min_value=1,max_value=2147483647)`

Example 1272563179
metadata.eventType
String Optional

`Fixed: "APIActivityAuditEvent"`

Source: `Fixed: "APIActivityAuditEvent"`

Example APIActivityAuditEvent
metadata.eventCreationTime
Integer Optional

`sec * 1000 + 37`

Source: `sec * 1000 + 37`

Example 1790894870037
metadata.version
String Optional

`Fixed: "1.0"`

Source: `Fixed: "1.0"`

Example 1.0
event.UserId
String Optional

`Fixed: ""`

Source: `Fixed: ""`

event.UserIp
String Optional

`device['ip_address']`

Source: `device['ip_address']`

Example 192.0.2.41
event.OperationName
String Optional

`Fixed: "logged"`

Source: `Fixed: "logged"`

Example logged
event.ServiceName
String Optional

`Fixed: "api_request"`

Source: `Fixed: "api_request"`

Example api_request
event.Success
Boolean Optional

`Fixed: true`

Source: `Fixed: true`

Example true
event.UTCTimestamp
Integer Optional

`sec`

Source: `sec`

Example 1790894870
event.Attributes.APIClientID
String Optional

`api_client_id` (random_guid)

Source: `api_client_id` (random_guid)

Example bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
event.Attributes.cid
String Optional

`cid` (random_string 32 hex)

Source: `cid` (random_string 32 hex)

Example aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
event.Attributes.consumes
String Optional

`Fixed: "[application/json]"`

Source: `Fixed: "[application/json]"`

Example [application/json]
event.Attributes.elapsed_microseconds
String Optional

`Fixed: "87719"`

Source: `Fixed: "87719"`

Example 87719
event.Attributes.elapsed_time
String Optional

`Fixed: "87.719978ms"`

Source: `Fixed: "87.719978ms"`

Example 87.719978ms
event.Attributes.produces
String Optional

`Fixed: "[application/json]"`

Source: `Fixed: "[application/json]"`

Example [application/json]
event.Attributes.received_time
String Optional

`((clock - 1) | strftime('%Y-%m-%dT%H:%M:%S')) + '.950073741Z'`

Source: `((clock - 1) | strftime('%Y-%m-%dT%H:%M:%S')) + '.950073741Z'`

Example 2026-10-01T22:47:49.950073741Z
event.Attributes.request_accept
String Optional

`Fixed: "*/*"`

Source: `Fixed: "*/*"`

Example */*
event.Attributes.request_content_type
String Optional

`Fixed: "application/json"`

Source: `Fixed: "application/json"`

Example application/json
event.Attributes.request_method
String Optional

`Fixed: "POST"`

Source: `Fixed: "POST"`

Example POST
event.Attributes.request_path
String Optional

`Fixed: "/path/to/something/v1/0"`

Source: `Fixed: "/path/to/something/v1/0"`

Example /path/to/something/v1/0
event.Attributes.request_query
String Optional

`Fixed: "https://example.com/"`

Source: `Fixed: "https://example.com/"`

Example https://example.com/
event.Attributes.request_uri_length
String Optional

`Fixed: "110"`

Source: `Fixed: "110"`

Example 110
event.Attributes.scopes
String Optional

`Fixed: "streaming:read"`

Source: `Fixed: "streaming:read"`

Example streaming:read
event.Attributes.status_code
String Optional

`Fixed: "404"`

Source: `Fixed: "404"`

Example 404
event.Attributes.trace_id
String Optional

`trace`

Source: `trace`

Example 7a11005a-772a-46b9-a05e-50b67def9ca3
event.Attributes.user_agent
String Optional

`Fixed: "sekoiaio-connector/crowdstrike-falcon-1.22.0"`

Source: `Fixed: "sekoiaio-connector/crowdstrike-falcon-1.22.0"`

Example sekoiaio-connector/crowdstrike-falcon-1.22.0
event.Attributes.user_ip
String Optional

`device['ip_address']`

Source: `device['ip_address']`

Example 192.0.2.41
event.Message
String Optional

`Fixed: ""`

Source: `Fixed: ""`

event.Source
String Optional

`Fixed: "api_request"`

Source: `Fixed: "api_request"`

Example api_request
event.SourceIp
String Optional

`device['ip_address']`

Source: `device['ip_address']`

Example 192.0.2.41
event.AuditKeyValues[0].Key
String Optional

`Fixed: "trace_id"`

Source: `Fixed: "trace_id"`

Example trace_id
event.AuditKeyValues[0].ValueString
String Optional

`trace`

Source: `trace`

Example 7a11005a-772a-46b9-a05e-50b67def9ca3
event.AuditKeyValues[1].Key
String Optional

`Fixed: "APIClientID"`

Source: `Fixed: "APIClientID"`

Example APIClientID
event.AuditKeyValues[1].ValueString
String Optional

`api_client_id` (random_guid)

Source: `api_client_id` (random_guid)

Example bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
event.AuditKeyValues[2].Key
String Optional

`Fixed: "consumes"`

Source: `Fixed: "consumes"`

Example consumes
event.AuditKeyValues[2].ValueString
String Optional

`Fixed: "[application/json]"`

Source: `Fixed: "[application/json]"`

Example [application/json]
event.AuditKeyValues[3].Key
String Optional

`Fixed: "elapsed_microseconds"`

Source: `Fixed: "elapsed_microseconds"`

Example elapsed_microseconds
event.AuditKeyValues[3].ValueString
String Optional

`Fixed: "87719"`

Source: `Fixed: "87719"`

Example 87719
event.AuditKeyValues[4].Key
String Optional

`Fixed: "cid"`

Source: `Fixed: "cid"`

Example cid
event.AuditKeyValues[4].ValueString
String Optional

`cid` (random_string 32 hex)

Source: `cid` (random_string 32 hex)

Example aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
event.AuditKeyValues[5].Key
String Optional

`Fixed: "produces"`

Source: `Fixed: "produces"`

Example produces
event.AuditKeyValues[5].ValueString
String Optional

`Fixed: "[application/json]"`

Source: `Fixed: "[application/json]"`

Example [application/json]
event.AuditKeyValues[6].Key
String Optional

`Fixed: "request_uri_length"`

Source: `Fixed: "request_uri_length"`

Example request_uri_length
event.AuditKeyValues[6].ValueString
String Optional

`Fixed: "110"`

Source: `Fixed: "110"`

Example 110
event.AuditKeyValues[7].Key
String Optional

`Fixed: "user_agent"`

Source: `Fixed: "user_agent"`

Example user_agent
event.AuditKeyValues[7].ValueString
String Optional

`Fixed: "sekoiaio-connector/crowdstrike-falcon-1.22.0"`

Source: `Fixed: "sekoiaio-connector/crowdstrike-falcon-1.22.0"`

Example sekoiaio-connector/crowdstrike-falcon-1.22.0
event.AuditKeyValues[8].Key
String Optional

`Fixed: "received_time"`

Source: `Fixed: "received_time"`

Example received_time
event.AuditKeyValues[8].ValueString
String Optional

`((clock - 1) | strftime('%Y-%m-%dT%H:%M:%S')) + '.950073741Z'`

Source: `((clock - 1) | strftime('%Y-%m-%dT%H:%M:%S')) + '.950073741Z'`

Example 2026-10-01T22:47:49.950073741Z
event.AuditKeyValues[9].Key
String Optional

`Fixed: "request_method"`

Source: `Fixed: "request_method"`

Example request_method
event.AuditKeyValues[9].ValueString
String Optional

`Fixed: "POST"`

Source: `Fixed: "POST"`

Example POST
event.AuditKeyValues[10].Key
String Optional

`Fixed: "status_code"`

Source: `Fixed: "status_code"`

Example status_code
event.AuditKeyValues[10].ValueString
String Optional

`Fixed: "404"`

Source: `Fixed: "404"`

Example 404
event.AuditKeyValues[11].Key
String Optional

`Fixed: "request_query"`

Source: `Fixed: "request_query"`

Example request_query
event.AuditKeyValues[11].ValueString
String Optional

`Fixed: "https://example.com/"`

Source: `Fixed: "https://example.com/"`

Example https://example.com/
event.AuditKeyValues[12].Key
String Optional

`Fixed: "request_accept"`

Source: `Fixed: "request_accept"`

Example request_accept
event.AuditKeyValues[12].ValueString
String Optional

`Fixed: "*/*"`

Source: `Fixed: "*/*"`

Example */*
event.AuditKeyValues[13].Key
String Optional

`Fixed: "request_content_type"`

Source: `Fixed: "request_content_type"`

Example request_content_type
event.AuditKeyValues[13].ValueString
String Optional

`Fixed: "application/json"`

Source: `Fixed: "application/json"`

Example application/json
event.AuditKeyValues[14].Key
String Optional

`Fixed: "request_path"`

Source: `Fixed: "request_path"`

Example request_path
event.AuditKeyValues[14].ValueString
String Optional

`Fixed: "/path/to/something/v1/0"`

Source: `Fixed: "/path/to/something/v1/0"`

Example /path/to/something/v1/0
event.AuditKeyValues[15].Key
String Optional

`Fixed: "scopes"`

Source: `Fixed: "scopes"`

Example scopes
event.AuditKeyValues[15].ValueString
String Optional

`Fixed: "streaming:read"`

Source: `Fixed: "streaming:read"`

Example streaming:read
event.AuditKeyValues[16].Key
String Optional

`Fixed: "user_ip"`

Source: `Fixed: "user_ip"`

Example user_ip
event.AuditKeyValues[16].ValueString
String Optional

`device['ip_address']`

Source: `device['ip_address']`

Example 192.0.2.41
event.AuditKeyValues[17].Key
String Optional

`Fixed: "elapsed_time"`

Source: `Fixed: "elapsed_time"`

Example elapsed_time
event.AuditKeyValues[17].ValueString
String Optional

`Fixed: "87.719978ms"`

Source: `Fixed: "87.719978ms"`

Example 87.719978ms