Skip to content




Traditional endpoint security tools have blind spots, making them unable to see and stop advanced threats. CrowdStrike Falcon Insight solves this by delivering complete endpoint visibility across your organization. Falcon Insight continuously monitors all endpoint activity and analyzes the data in real time to automatically identify threat activity, enabling it to both detect and prevent advanced threats as they happen. All endpoint activity is also streamed to the CrowdStrike Falcon platform so that security teams can rapidly investigate incidents, respond to alerts and proactively hunt for new threats.

Product Details

Vendor URL: Crowdstrike

Product Type: EDR

Product Tier: Tier I

Integration Method: Chronicle

Integration URL: Crowdstrike - Cyderes Documentation

Log Guide: Sample Logs by Log Type

Parser Details

Log Format: JSON

Expected Normalization Rate: near 100%

Data Label: CS_EDR

UDM Fields (list of all UDM fields leveraged in the Parser):

Log File Field UDM Field

Product Event Types

Event UDM Event Classification alerting enabled

Log Sample

  "RawTargetProcessId": "targetpid",
  "aip": "",
  "TargetAddress": "target",
  "event_platform": "Win",
  "id": "id",
  "EffectiveTransmissionClass": "3",
  "ApcContextAddress": "contextaddr",
  "timestamp": "1624308287596",
  "event_simpleName": "QueueApcEtw",
  "RawProcessId": "4",
  "TargetThreadId": "targethread",
  "ContextTimeStamp": "1624308281.188",
  "ConfigStateHash": "hash",
  "ContextProcessId": "processid",
  "ApcArgument1": "argid1",
  "ApcArgument2": "argid2",
  "ConfigBuild": "1007.3.0013806.1",
  "ApcContextFileName": "\\Device\\HarddiskVolume1\\Windows\\System32\\ntdll.dll",
  "TargetProcessId": "targetpid",
  "Entitlements": "15",
  "name": "QueueApcEtwV1",
  "RawThreadId": "11376",
  "aid": "aid",
  "RawTargetThreadId": "4420",
  "cid": "cid",
  "TargetFileName": ""

Sample Parsing

metadata.event_timestamp = "2021-06-21T20:44:47.596Z"
metadata.event_type = "GENERIC_EVENT"
metadata.vendor_name = "Crowdstrike"
metadata.product_name = "Falcon"
metadata.product_event_type = "QueueApcEtw"
metadata.description = "QueueApcEtwV1"
metadata.ingested_timestamp = "2021-06-21T20:57:45.723Z"
principal.hostname = "hostname1"
principal.asset_id = "CS:aid" = "4"
principal.process.product_specific_process_id = "CS:processid"
principal.platform = "WINDOWS"
principal.nat_ip = "" = "targetpid"
target.process.file.sha256 = "hash"
target.process.file.md5 = "md5"
target.process.file.sha1 = "sha1"
target.process.file.full_path = "\Device\HarddiskVolume1\Windows\System32\vdsldr.exe"
target.process.command_line = "C:\WINDOWS\System32\vdsldr.exe -Embedding"
target.process.product_specific_process_id = "CS:targetpid" = "id"

Parser Alerting

Alerting criteria is listed in the Product Event Types table above.


Coming Soon