Event type
CrowdStrike session-end
session-end; sample-backed independent native Event Streams JSON replica. Registry identities and fresh UTC clock; not a sequenced stream.
Overview
What this event covers
Narrow documented reference profile. Uses schema-standard registry fields (user.email, device.ip_address/hostname) plus generated CrowdStrike IDs (CID, client/detection/group IDs). Works with the default entity sample.
When generated
- ›RemoteResponseSessionEndEvent
Security relevance
InformationalFrequency notes
Local test rate only. Independent records; no lifecycle simulation.
Resources
Docs and tools
Generation
Configuration
- Base frequency
- 3600 events/hour
- Business hours
- 1.0x
- Night hours
- 1.0x
- Weekend
- 1.0x
Schema
Field definitions
Field reference for this event type — types, requirements, examples, and allowed values.
metadata.customerIDString
`cid` (random_string 32 hex)
Source: `cid` (random_string 32 hex)
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaametadata.offset
`fake.pyint(min_value=1,max_value=2147483647)`
Source: `fake.pyint(min_value=1,max_value=2147483647)`
1056427602metadata.eventType
`Fixed: "RemoteResponseSessionEndEvent"`
Source: `Fixed: "RemoteResponseSessionEndEvent"`
RemoteResponseSessionEndEventmetadata.eventCreationTime
`sec * 1000`
Source: `sec * 1000`
1790894876000metadata.version
`Fixed: "1.0"`
Source: `Fixed: "1.0"`
1.0event.SessionId
`fake.uuid4()`
Source: `fake.uuid4()`
97b38bd4-7a11-405a-b72a-66b9605e50b6event.HostnameField
`device['hostname']`
Source: `device['hostname']`
ben.rivera-clientevent.UserName
`user['email']`
Source: `user['email']`
ben.rivera@example.comevent.EndTimestamp
`sec`
Source: `sec`
1790894876