MELTr
Home Vendors Search Download
Login
Vendors / CrowdStrike / Falcon Platform / CrowdStrike group-member-added
CrowdStrike logo

Event type

CrowdStrike group-member-added

group-member-added; sample-backed independent native Event Streams JSON replica. Registry identities and fresh UTC clock; not a sequenced stream.

JSON 14 fields Generator

crowdstrike audit
Preview Sample View Schema
CLI Install
meltr templates install crowdstrike

Overview

What this event covers

Narrow documented reference profile. Uses schema-standard registry fields (user.email, device.ip_address/hostname) plus generated CrowdStrike IDs (CID, client/detection/group IDs). Works with the default entity sample.

When generated

  • ›update_group

Security relevance

Informational

Frequency notes

Local test rate only. Independent records; no lifecycle simulation.

Resources

Docs and tools

Full reference event reference

Generation

Configuration

Base frequency
3600 events/hour
Business hours
1.0x
Night hours
1.0x
Weekend
1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

metadata.customerIDString
String Optional

`cid` (random_string 32 hex)

Source: `cid` (random_string 32 hex)

Example aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
metadata.offset
Integer Optional

`fake.pyint(min_value=1,max_value=2147483647)`

Source: `fake.pyint(min_value=1,max_value=2147483647)`

Example 1056427602
metadata.eventType
String Optional

`Fixed: "UserActivityAuditEvent"`

Source: `Fixed: "UserActivityAuditEvent"`

Example UserActivityAuditEvent
metadata.eventCreationTime
Integer Optional

`sec * 1000`

Source: `sec * 1000`

Example 1790894876000
metadata.version
String Optional

`Fixed: "1.0"`

Source: `Fixed: "1.0"`

Example 1.0
event.UserId
String Optional

`user['email']`

Source: `user['email']`

Example ben.rivera@example.com
event.UserIp
String Optional

`device['ip_address']`

Source: `device['ip_address']`

Example 192.0.2.41
event.OperationName
String Optional

`Fixed: "update_group"`

Source: `Fixed: "update_group"`

Example update_group
event.ServiceName
String Optional

`Fixed: "groups"`

Source: `Fixed: "groups"`

Example groups
event.AuditKeyValues[0].Key
String Optional

`Fixed: "group_id"`

Source: `Fixed: "group_id"`

Example group_id
event.AuditKeyValues[0].ValueString
String Optional

`group_id` (random_guid)

Source: `group_id` (random_guid)

Example cccccccccccccccccccccccccccccccc
event.AuditKeyValues[1].Key
String Optional

`Fixed: "action_name"`

Source: `Fixed: "action_name"`

Example action_name
event.AuditKeyValues[1].ValueString
String Optional

`Fixed: "add_group_member"`

Source: `Fixed: "add_group_member"`

Example add_group_member
event.UTCTimestamp
Integer Optional

`sec`

Source: `sec`

Example 1790894876