Event type
CrowdStrike two-factor-success
two-factor-success; sample-backed independent native Event Streams JSON replica. Registry identities and fresh UTC clock; not a sequenced stream.
Overview
What this event covers
Narrow documented reference profile. Uses schema-standard registry fields (user.email, device.ip_address/hostname) plus generated CrowdStrike IDs (CID, client/detection/group IDs). Works with the default entity sample.
When generated
- ›twoFactorAuthenticate
Security relevance
InformationalFrequency notes
Local test rate only. Independent records; no lifecycle simulation.
Resources
Docs and tools
Generation
Configuration
- Base frequency
- 3600 events/hour
- Business hours
- 1.0x
- Night hours
- 1.0x
- Weekend
- 1.0x
Schema
Field definitions
Field reference for this event type — types, requirements, examples, and allowed values.
metadata.customerIDString
`cid` (random_string 32 hex)
Source: `cid` (random_string 32 hex)
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaametadata.offset
`fake.pyint(min_value=1,max_value=2147483647)`
Source: `fake.pyint(min_value=1,max_value=2147483647)`
426427764metadata.eventType
`Fixed: "AuthActivityAuditEvent"`
Source: `Fixed: "AuthActivityAuditEvent"`
AuthActivityAuditEventmetadata.eventCreationTime
`ms`
Source: `ms`
1790894870944metadata.version
`Fixed: "1.0"`
Source: `Fixed: "1.0"`
1.0event.UserId
`user['email']`
Source: `user['email']`
ben.rivera@example.comevent.UserIp
`device['ip_address']`
Source: `device['ip_address']`
192.0.2.41event.OperationName
`Fixed: "twoFactorAuthenticate"`
Source: `Fixed: "twoFactorAuthenticate"`
twoFactorAuthenticateevent.ServiceName
`Fixed: "CrowdStrike Authentication"`
Source: `Fixed: "CrowdStrike Authentication"`
CrowdStrike Authenticationevent.Success
`Fixed: true`
Source: `Fixed: true`
trueevent.UTCTimestamp
`ms`
Source: `ms`
1790894870944