Event type
CrowdStrike session-start
session-start; sample-backed independent native Event Streams JSON replica. Registry identities and fresh UTC clock; not a sequenced stream.
Overview
What this event covers
Narrow documented reference profile. Uses schema-standard registry fields (user.email, device.ip_address/hostname) plus generated CrowdStrike IDs (CID, client/detection/group IDs). Works with the default entity sample.
When generated
- ›RemoteResponseSessionStartEvent
Security relevance
InformationalFrequency notes
Local test rate only. Independent records; no lifecycle simulation.
Resources
Docs and tools
Generation
Configuration
- Base frequency
- 3600 events/hour
- Business hours
- 1.0x
- Night hours
- 1.0x
- Weekend
- 1.0x
Schema
Field definitions
Field reference for this event type — types, requirements, examples, and allowed values.
metadata.customerIDString
`cid` (random_string 32 hex)
Source: `cid` (random_string 32 hex)
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaametadata.offset
`fake.pyint(min_value=1,max_value=2147483647)`
Source: `fake.pyint(min_value=1,max_value=2147483647)`
457598004metadata.eventType
`Fixed: "RemoteResponseSessionStartEvent"`
Source: `Fixed: "RemoteResponseSessionStartEvent"`
RemoteResponseSessionStartEventmetadata.eventCreationTime
`sec * 1000`
Source: `sec * 1000`
1790894876000metadata.version
`Fixed: "1.0"`
Source: `Fixed: "1.0"`
1.0event.SessionId
`fake.uuid4()`
Source: `fake.uuid4()`
2f95f787-a751-466c-b999-538dc93832d2event.HostnameField
`device['hostname']`
Source: `device['hostname']`
casey.patel-clientevent.UserName
`user['email']`
Source: `user['email']`
casey.patel@example.comevent.StartTimestamp
`sec`
Source: `sec`
1790894876