Vendors / CrowdStrike / Falcon Platform / Falcon API Activity Audit

Event type

Falcon API Activity Audit

Event Streams APIActivityAuditEvent for Falcon API requests

CrowdStrike Falcon Event Streams API activity audit events for Falcon API client requests

JSON 9 fields High Generator

api-audit event-streams crowdstrike authentication

Preview Sample View Schema

CLI Install

meltr templates install crowdstrike

Overview

What this event covers

Emits CrowdStrike Falcon Event Streams records with metadata.eventType APIActivityAuditEvent for Falcon API client calls (ServiceName api_request). Matches the native {metadata, event} envelope including Attributes and AuditKeyValues — not AuthActivityAuditEvent console login events, and without third-party TA connector enrichment.

When generated

›Falcon API OAuth client issues a request against Falcon APIs
›Event Streams subscribers receive API activity audit events
›SIEM connectors ingest APIActivityAuditEvent from the data feed

Frequency notes

High-volume in environments with active API automation, connectors, and scripting. Rate tracks API client traffic more than interactive console use.

Generation

Configuration

Base frequency: 120 events/hour
Time patterns: business_hours night_hours weekend

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

metadata.eventType

String Required

Event Streams type for API request audits

Source: Static: APIActivityAuditEvent

Example APIActivityAuditEvent

metadata.customerIDString

String Required

Falcon customer ID (CID), 32-character lowercase hex

Source: random_string(32, hex)

Format 32-char hex

Example 7b96de6bd86847bd9dad470057cbbc6a

metadata.eventCreationTime

Integer Required

Event creation time in Unix epoch milliseconds

Source: unix_timestamp * 1000

Example 1750935017037

event.OperationName

String Required

Audit operation name for API request logging

Source: Static: logged

Example logged

event.ServiceName

String Required

Service that produced the audit record

Source: Static: api_request

Example api_request

event.Success

Boolean Required

Whether the API request succeeded (correlated with 2xx status_code)

Source: status_code in ['200', '201']

Example true

event.UserId

String Required

Console user id; empty for API-client requests

Source: Static empty string

event.Attributes

Object Required

Flattened API request attributes (APIClientID, cid, method, path, scopes, status_code, consumes/produces, timings, etc.)

Source: Built audit_attrs map mirrored into AuditKeyValues

event.AuditKeyValues

Array Required

Key/ValueString pairs mirroring Attributes for audit consumers

Source: Array of {Key, ValueString} from audit_attrs