Vendors / CrowdStrike / Falcon Platform / CrowdStrike legacy-detection-assigned

Event type

CrowdStrike legacy-detection-assigned

legacy-detection-assigned; sample-backed independent native Event Streams JSON replica. Registry identities and fresh UTC clock; not a sequenced stream.

JSON 18 fields Generator

crowdstrike audit

Preview Sample View Schema

CLI Install

meltr templates install crowdstrike

Overview

What this event covers

Narrow documented reference profile. Uses schema-standard registry fields (user.email, device.ip_address/hostname) plus generated CrowdStrike IDs (CID, client/detection/group IDs). Works with the default entity sample.

When generated

›detection_update

Security relevance

Informational

Frequency notes

Local test rate only. Independent records; no lifecycle simulation.

Resources

Docs and tools

Full reference event reference

Generation

Configuration

Base frequency: 3600 events/hour
Business hours: 1.0x
Night hours: 1.0x
Weekend: 1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

metadata.customerIDString

String Optional

`cid` (random_string 32 hex)

Source: `cid` (random_string 32 hex)

Example aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

metadata.offset

Integer Optional

`fake.pyint(min_value=1,max_value=2147483647)`

Source: `fake.pyint(min_value=1,max_value=2147483647)`

Example 820887982

metadata.eventType

String Optional

`Fixed: "UserActivityAuditEvent"`

Source: `Fixed: "UserActivityAuditEvent"`

Example UserActivityAuditEvent

metadata.eventCreationTime

Integer Optional

`sec * 1000`

Source: `sec * 1000`

Example 1790894876000

metadata.version

String Optional

`Fixed: "1.0"`

Source: `Fixed: "1.0"`

Example 1.0

event.UserId

String Optional

`user['email']`

Source: `user['email']`

Example casey.patel@example.com

event.UserIp

String Optional

`device['ip_address']`

Source: `device['ip_address']`

Example 192.0.2.42

event.OperationName

String Optional

`Fixed: "detection_update"`

Source: `Fixed: "detection_update"`

Example detection_update

event.ServiceName

String Optional

`Fixed: "detections"`

Source: `Fixed: "detections"`

Example detections

event.AuditKeyValues[0].Key

String Optional

`Fixed: "detection_id"`

Source: `Fixed: "detection_id"`

Example detection_id

event.AuditKeyValues[0].ValueString

String Optional

`detection_id` (generated)

Source: `detection_id` (generated)

Example ldt:dddddddddddddddddddddddddddddddd:17180539745

event.AuditKeyValues[1].Key

String Optional

`Fixed: "new_state"`

Source: `Fixed: "new_state"`

Example new_state

event.AuditKeyValues[1].ValueString

String Optional

`Fixed: "in_progress"`

Source: `Fixed: "in_progress"`

Example in_progress

event.AuditKeyValues[2].Key

String Optional

`Fixed: "assigned_to"`

Source: `Fixed: "assigned_to"`

Example assigned_to

event.AuditKeyValues[2].ValueString

String Optional

`user['full_name']`

Source: `user['full_name']`

Example Casey Patel

event.AuditKeyValues[3].Key

String Optional

`Fixed: "assigned_to_uid"`

Source: `Fixed: "assigned_to_uid"`

Example assigned_to_uid

event.AuditKeyValues[3].ValueString

String Optional

`user['email']`

Source: `user['email']`

Example casey.patel@example.com

event.UTCTimestamp

Integer Optional

`sec`

Source: `sec`

Example 1790894876