Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

The tags beginning with edr.crowdstrike identify events generated by Crowdstrike CrowdStrike.

Tag structure

The full tag must have 3 levels. The first two are fixed asedr.crowdstrike. The third level identifies the type of events sent, and the fourth level indicates the event subtype.

Crowdstrike

Product / Services

Tags

Data tables

CrowdStrike Cannon

edr.crowdstrike.cannon

edr.crowdstrike.cannon

edr.crowdstrike.cannon.additionalhostinfo

edr.crowdstrike.cannon.additionalhostinfo

edr.crowdstrike.cannon.agentconnect

edr.crowdstrike.cannon.agentconnect

edr.crowdstrike.cannon.agentonline

edr.crowdstrike.cannon.agentonline

edr.crowdstrike.cannon.arcfilewritten

edr.crowdstrike.cannon.arcfilewritten

edr.crowdstrike.cannon.asepkeyupdate

edr.crowdstrike.cannon.asepkeyupdate

edr.crowdstrike.cannon.asepvalueupdate

edr.crowdstrike.cannon.asepvalueupdate

edr.crowdstrike.cannon.associateindicator

edr.crowdstrike.cannon.associateindicator

edr.crowdstrike.cannon.associatetreeidwithroot

edr.crowdstrike.cannon.associatetreeidwithroot

edr.crowdstrike.cannon.billinginfo

edr.crowdstrike.cannon.billinginfo

edr.crowdstrike.cannon.bitsjobcreated

edr.crowdstrike.cannon.bitsjobcreated

edr.crowdstrike.cannon.bmpfilewritten

edr.crowdstrike.cannon.bmpfilewritten

edr.crowdstrike.cannon.cabfilewritten

edr.crowdstrike.cannon.cabfilewritten

edr.crowdstrike.cannon.channeldatadownloadcomplete

edr.crowdstrike.cannon.channeldatadownloadcomplete

edr.crowdstrike.cannon.channelversionrequired

edr.crowdstrike.cannon.channelversionrequired

edr.crowdstrike.cannon.detectionexcludedcommandhistory

edr.crowdstrike.cannon.detectionexcludedcommandhistory

edr.crowdstrike.cannon.dnsrequestconfigstateupdate

edr.crowdstrike.cannon.dnsrequestconfigstateupdate

edr.crowdstrike.cannon.endofprocesscreateservice

edr.crowdstrike.cannon.endofprocesscreateservice

edr.crowdstrike.cannon.neighborlistip4criticalenvironmentvariablechanged

edr.crowdstrike.cannon.neighborlistip4criticalenvironmentvariablechanged

edr.crowdstrike.cannon.networkconnectip4criticalfileaccessed

edr.crowdstrike.cannon.networkconnectip4criticalfileaccessed

edr.crowdstrike.cannon.othercurrentsystemtags

edr.crowdstrike.cannon.othercurrentsystemtags

edr.crowdstrike.cannon.processrollup2dconline

edr.crowdstrike.cannon.processrollup2dconline

edr.crowdstrike.cannon.processrollup2statsdcstatus

edr.crowdstrike.cannon.processrollup2statsdcstatus

edr.crowdstrike.cannon.sensorheartbeatdcsyncattempted

edr.crowdstrike.cannon.sensorheartbeatdcsyncattempted

edr.crowdstrike.cannon.syntheticprocessrollup2dcusbconfigurationdescriptor

edr.crowdstrike.cannon.syntheticprocessrollup2dcusbconfigurationdescriptor

edr.crowdstrike.falconstreamingcannon.agentsdcusbdeviceblocked

edr.crowdstrike.falconstreamingcannon.agentsdcusbdeviceblocked

edr.crowdstrike.falconstreamingcannon.auth_activitydcusbdeviceconnected

edr.crowdstrike.falconstreamingcannon.auth_activitydcusbdeviceconnected

edr.crowdstrike.falconstreamingcannon.behaviorsdcusbdevicedisconnected

edr.crowdstrike.falconstreamingcannon.behaviorsdcusbdevicedisconnected

edr.crowdstrike.falconstreamingcannon.customer_iocdcusbendpointdescriptor

edr.crowdstrike.falconstreamingcannon.customer_iocdcusbendpointdescriptor

edr.crowdstrike.falconstreamingcannon.detection_summarydcusbhiddescriptor

edr.crowdstrike.falconstreamingcannon.detection_summarydcusbhiddescriptor

edr.crowdstrike.falconstreamingcannon.external_apidcusbinterfacedescriptor

edr.crowdstrike.falconstreamingcannon.external_apidcusbinterfacedescriptor

edr.crowdstrike.falconstreamingcannon.firewall_matchdeliverlocalfxtocloud

edr.crowdstrike.falconstreamingcannon.firewall_matchdeliverlocalfxtocloud

edr.crowdstrike.falconstreamingcannon.identity_protectionedr.crowdstrike.detectionexcluded

edr.crowdstrike.cannon.detectionexcluded

edr.crowdstrike.cannon.directorycreate

edr.crowdstrike.cannon.directorycreate

edr.crowdstrike.cannon.directorytraversaloversmb

edr.crowdstrike.cannon.directorytraversaloversmb

edr.crowdstrike.cannon.diskcapacity

edr.crowdstrike.cannon.diskcapacity

edr.crowdstrike.cannon.dllinjection

edr.crowdstrike.cannon.dllinjection

edr.crowdstrike.cannon.dmpfilewritten

edr.crowdstrike.cannon.dmpfilewritten

edr.crowdstrike.cannon.dnsrequest

edr.crowdstrike.cannon.dnsrequest

edr.crowdstrike.cannon.documentprograminjectedthread

edr.crowdstrike.cannon.documentprograminjectedthread

edr.crowdstrike.cannon.driverload

edr.crowdstrike.cannon.driverload

edr.crowdstrike.cannon.dwgfilewritten

edr.crowdstrike.cannon.dwgfilewritten

edr.crowdstrike.cannon.elffilewritten

edr.crowdstrike.cannon.elffilewritten

edr.crowdstrike.cannon.endofprocess

edr.crowdstrike.cannon.endofprocess

edr.crowdstrike.cannon.errorevent

edr.crowdstrike.cannon.errorevent

edr.crowdstrike.cannon.etwcomponentresponse

edr.crowdstrike.cannon.etwcomponentresponse

edr.crowdstrike.cannon.etwerrorevent

edr.crowdstrike.cannon.etwerrorevent

edr.crowdstrike.cannon.executabledeleted

edr.crowdstrike.cannon.executabledeleted

edr.crowdstrike.cannon.falconservicestatus

edr.crowdstrike.cannon.falconservicestatus

edr.crowdstrike.cannon.filedeleted

edr.crowdstrike.cannon.filedeleted

edr.crowdstrike.cannon.filedeleteinfo

edr.crowdstrike.cannon.filedeleteinfo

edr.crowdstrike.cannon.fileopeninfo

edr.crowdstrike.cannon.fileopeninfo

edr.crowdstrike.cannon.filerenameinfo

edr.crowdstrike.cannon.filerenameinfo

edr.crowdstrike.cannon.firewallchangeoption

edr.crowdstrike.cannon.firewallchangeoption

edr.crowdstrike.cannon.firewalldeleterule

edr.crowdstrike.cannon.firewalldeleterule

edr.crowdstrike.cannon.firewallsetrule

edr.crowdstrike.cannon.firewallsetrule

edr.crowdstrike.cannon.firmwareanalysishardwaredata

edr.crowdstrike.cannon.firmwareanalysishardwaredata

edr.crowdstrike.cannon.firmwareanalysisstatus

edr.crowdstrike.cannon.firmwareanalysisstatus

edr.crowdstrike.cannon.fspostopensnapshotfile

edr.crowdstrike.cannon.fspostopensnapshotfile

edr.crowdstrike.cannon.fsvolumemounted

edr.crowdstrike.cannon.fsvolumemounted

edr.crowdstrike.cannon.fsvolumeunmounted

edr.crowdstrike.cannon.fsvolumeunmounted

edr.crowdstrike.cannon.genericfilewritten

edr.crowdstrike.cannon.genericfilewritten

edr.crowdstrike.cannon.giffilewritten

edr.crowdstrike.cannon.giffilewritten

edr.crowdstrike.cannon.gzipfilewritten

edr.crowdstrike.cannon.gzipfilewritten

edr.crowdstrike.cannon.hostedservicestarted

edr.crowdstrike.cannon.hostedservicestarted

edr.crowdstrike.cannon.hostedservicestopped

edr.crowdstrike.cannon.hostedservicestopped

edr.crowdstrike.cannon.hostinfo

edr.crowdstrike.cannon.hostinfo

edr.crowdstrike.cannon.hostnamechanged

edr.crowdstrike.cannon.hostnamechanged

edr.crowdstrike.cannon.imagehash

edr.crowdstrike.cannon.imagehash

edr.crowdstrike.cannon.injectedthread

edr.crowdstrike.cannon.injectedthread

edr.crowdstrike.cannon.installedapplication

edr.crowdstrike.cannon.installedapplication

edr.crowdstrike.cannon.installedupdates

edr.crowdstrike.cannon.installedupdates

edr.crowdstrike.cannon.invalid

edr.crowdstrike.cannon.invalid

edr.crowdstrike.cannon.iosessionconnected

edr.crowdstrike.cannon.iosessionconnected

edr.crowdstrike.cannon.iosessionloggedon

edr.crowdstrike.cannon.iosessionloggedon

edr.crowdstrike.cannon.jarfilewritten

edr.crowdstrike.cannon.jarfilewritten

edr.crowdstrike.cannon.javaclassfilewritten

edr.crowdstrike.cannon.javaclassfilewritten

edr.crowdstrike.cannon.jpegfilewritten

edr.crowdstrike.cannon.jpegfilewritten

edr.crowdstrike.cannon.kernelmodeloadimage

edr.crowdstrike.cannon.kernelmodeloadimage

edr.crowdstrike.cannon.lfodownloadconfirmation

edr.crowdstrike.cannon.lfodownloadconfirmation

edr.crowdstrike.cannon.localipaddressip4

edr.crowdstrike.cannon.localipaddressip4

edr.crowdstrike.cannon.localipaddressip6

edr.crowdstrike.cannon.localipaddressip6

edr.crowdstrike.cannon.localipaddressremovedip4

edr.crowdstrike.cannon.localipaddressremovedip4

edr.crowdstrike.cannon.localipaddressremovedip6

edr.crowdstrike.cannon.localipaddressremovedip6

edr.crowdstrike.cannon.lsasshandlefromunsignedmodule

edr.crowdstrike.cannon.lsasshandlefromunsignedmodule

edr.crowdstrike.cannon.manifestdownloadcomplete

edr.crowdstrike.cannon.manifestdownloadcomplete

edr.crowdstrike.cannon.modifyservicebinary

edr.crowdstrike.cannon.modifyservicebinary

edr.crowdstrike.cannon.neighborlistip4

edr.crowdstrike.cannon.neighborlistip4

edr.crowdstrike.cannon.neighborlistip6

edr.crowdstrike.cannon.neighborlistip6

edr.crowdstrike.cannon.netshareadd

edr.crowdstrike.cannon.netshareadd

edr.crowdstrike.cannon.netsharesecuritymodify

edr.crowdstrike.cannon.netsharesecuritymodify

edr.crowdstrike.cannon.networkcapableasepwrite

edr.crowdstrike.cannon.networkcapableasepwrite

edr.crowdstrike.cannon.networkcloseip4

edr.crowdstrike.cannon.networkcloseip4

edr.crowdstrike.cannon.networkcloseip6

edr.crowdstrike.cannon.networkcloseip6

edr.crowdstrike.cannon.networkconnectip4

edr.crowdstrike.cannon.networkconnectip4

edr.crowdstrike.cannon.networkconnectip6

edr.crowdstrike.cannon.networkconnectip6

edr.crowdstrike.cannon.networklistenip4

edr.crowdstrike.cannon.networklistenip4

edr.crowdstrike.cannon.networklistenip6

edr.crowdstrike.cannon.networklistenip6

edr.crowdstrike.cannon.networkreceiveacceptip4

edr.crowdstrike.cannon.networkreceiveacceptip4

edr.crowdstrike.cannon.networkreceiveacceptip6

edr.crowdstrike.cannon.networkreceiveacceptip6

edr.crowdstrike.cannon.newexecutablerenamed

edr.crowdstrike.cannon.newexecutablerenamed

edr.crowdstrike.cannon.newexecutablewritten

edr.crowdstrike.cannon.newexecutablewritten

edr.crowdstrike.cannon.newscriptwritten

edr.crowdstrike.cannon.newscriptwritten

edr.crowdstrike.cannon.olefilewritten

edr.crowdstrike.cannon.olefilewritten

edr.crowdstrike.cannon.ooxmlfilewritten

edr.crowdstrike.cannon.ooxmlfilewritten

edr.crowdstrike.cannon.osversioninfo

edr.crowdstrike.cannon.osversioninfo

edr.crowdstrike.cannon.other

edr.crowdstrike.cannon.other

edr.crowdstrike.cannon.packedexecutablewritten

edr.crowdstrike.cannon.packedexecutablewritten

edr.crowdstrike.cannon.pdffilewritten

edr.crowdstrike.cannon.pdffilewritten

edr.crowdstrike.cannon.pefilewritten

edr.crowdstrike.cannon.pefilewritten

edr.crowdstrike.cannon.pngfilewritten

edr.crowdstrike.cannon.pngfilewritten

edr.crowdstrike.cannon.privilegedprocesshandlefromunsignedmodule

edr.crowdstrike.cannon.privilegedprocesshandlefromunsignedmodule

edr.crowdstrike.cannon.processinjection

edr.crowdstrike.cannon.processinjection

edr.crowdstrike.cannon.processrollup2

edr.crowdstrike.cannon.processrollup2

edr.crowdstrike.cannon.processrollup2stats

edr.crowdstrike.cannon.processrollup2stats

edr.crowdstrike.cannon.processselfdeleted

edr.crowdstrike.cannon.processselfdeleted

edr.crowdstrike.cannon.promiscuousbindip4

edr.crowdstrike.cannon.promiscuousbindip4

edr.crowdstrike.cannon.queueapcetw

edr.crowdstrike.cannon.queueapcetw

edr.crowdstrike.cannon.ransomwareopenfile

edr.crowdstrike.cannon.ransomwareopenfile

edr.crowdstrike.cannon.rarfilewritten

edr.crowdstrike.cannon.rarfilewritten

edr.crowdstrike.cannon.rawbindip4

edr.crowdstrike.cannon.rawbindip4

edr.crowdstrike.cannon.rawbindip6

edr.crowdstrike.cannon.rawbindip6

edr.crowdstrike.cannon.reflectivedotnedmoduleload

edr.crowdstrike.cannon.reflectivedotnedmoduleload

edr.crowdstrike.cannon.reggenericvalueupdate

edr.crowdstrike.cannon.reggenericvalueupdate

edr.crowdstrike.cannon.registerrawinputdevicesetw

edr.crowdstrike.cannon.registerrawinputdevicesetw

edr.crowdstrike.cannon.regsystemconfigvalueupdate

edr.crowdstrike.cannon.regsystemconfigvalueupdate

edr.crowdstrike.cannon.removablemediavolumemounted

edr.crowdstrike.cannon.removablemediavolumemounted

edr.crowdstrike.cannon.resourceutilization

edr.crowdstrike.cannon.resourceutilization

edr.crowdstrike.cannon.rtffilewritten

edr.crowdstrike.cannon.rtffilewritten

edr.crowdstrike.cannon.samhashdumpfromunsignedmodule

edr.crowdstrike.cannon.samhashdumpfromunsignedmodule

edr.crowdstrike.cannon.scheduledtaskdeleted

edr.crowdstrike.cannon.scheduledtaskdeleted

edr.crowdstrike.cannon.scheduledtaskmodified

edr.crowdstrike.cannon.scheduledtaskmodified

edr.crowdstrike.cannon.scheduledtaskregistered

edr.crowdstrike.cannon.scheduledtaskregistered

edr.crowdstrike.cannon.screenshottakentw

edr.crowdstrike.cannon.screenshottakentw

edr.crowdstrike.cannon.scriptcontroldetectioninfo

edr.crowdstrike.cannon.scriptcontroldetectioninfo

edr.crowdstrike.cannon.scriptcontrolscantelemetry

edr.crowdstrike.cannon.scriptcontrolscantelemetry

edr.crowdstrike.cannon.sensitivewmiquery

edr.crowdstrike.cannon.sensitivewmiquery

edr.crowdstrike.cannon.sensorheartbeat

edr.crowdstrike.cannon.sensorheartbeat

edr.crowdstrike.cannon.servicestarted

edr.crowdstrike.cannon.servicestarted

edr.crowdstrike.cannon.setwineventhooketw

edr.crowdstrike.cannon.setwineventhooketw

edr.crowdstrike.cannon.sevenzipfilewritten

edr.crowdstrike.cannon.sevenzipfilewritten

edr.crowdstrike.cannon.signinfoerror

edr.crowdstrike.cannon.signinfoerror

edr.crowdstrike.cannon.signinfowithcertandcontext

edr.crowdstrike.cannon.signinfowithcertandcontext

edr.crowdstrike.cannon.signinfowithcontext

edr.crowdstrike.cannon.signinfowithcontext

edr.crowdstrike.cannon.smbclientshareclosedetw

edr.crowdstrike.cannon.smbclientshareclosedetw

edr.crowdstrike.cannon.smbclientshareopenedetw

edr.crowdstrike.cannon.smbclientshareopenedetw

edr.crowdstrike.cannon.snapshotvolumemounted

edr.crowdstrike.cannon.snapshotvolumemounted

edr.crowdstrike.cannon.suspectcreatethreadstack

edr.crowdstrike.cannon.suspectcreatethreadstack

edr.crowdstrike.cannon.suspiciouscreatesymboliclink

edr.crowdstrike.cannon.suspiciouscreatesymboliclink

edr.crowdstrike.cannon.suspiciouslackofprocessrollupevents

edr.crowdstrike.cannon.suspiciouslackofprocessrollupevents

edr.crowdstrike.cannon.suspiciousprivilegedprocesshandle

edr.crowdstrike.cannon.suspiciousprivilegedprocesshandle

edr.crowdstrike.cannon.suspiciousregasepupdate

edr.crowdstrike.cannon.suspiciousregasepupdate

edr.crowdstrike.cannon.syntheticprocessrollup2

edr.crowdstrike.cannon.syntheticprocessrollup2

edr.crowdstrike.cannon.systemcapacity

edr.crowdstrike.cannon.systemcapacity

edr.crowdstrike.cannon.tarfilewritten

edr.crowdstrike.cannon.tarfilewritten

edr.crowdstrike.cannon.tcgpcrinfo

edr.crowdstrike.cannon.tcgpcrinfo

edr.crowdstrike.cannon.terminateprocess

edr.crowdstrike.cannon.terminateprocess

edr.crowdstrike.cannon.tifffilewritten

edr.crowdstrike.cannon.tifffilewritten

edr.crowdstrike.cannon.tokenimpersonated

edr.crowdstrike.cannon.tokenimpersonated

edr.crowdstrike.cannon.umppaerrorevent

edr.crowdstrike.cannon.umppaerrorevent

edr.crowdstrike.cannon.umppcbypasssuspected

edr.crowdstrike.cannon.umppcbypasssuspected

edr.crowdstrike.cannon.updatemanifestdownloadcomplete

edr.crowdstrike.cannon.updatemanifestdownloadcomplete

edr.crowdstrike.cannon.useraccountaddedtogroup

edr.crowdstrike.cannon.useraccountaddedtogroup

edr.crowdstrike.cannon.userexceptiondep

edr.crowdstrike.cannon.userexceptiondep

edr.crowdstrike.cannon.userfontload

edr.crowdstrike.cannon.userfontload

edr.crowdstrike.cannon.useridentity

edr.crowdstrike.cannon.useridentity

edr.crowdstrike.cannon.userinformationetw

edr.crowdstrike.cannon.userinformationetw

edr.crowdstrike.cannon.userlogoff

edr.crowdstrike.cannon.userlogoff

edr.crowdstrike.cannon.userlogon

edr.crowdstrike.cannon.userlogon

edr.crowdstrike.cannon.userlogonfailed

edr.crowdstrike.cannon.userlogonfailed

edr.crowdstrike.cannon.userlogonfailed2

edr.crowdstrike.cannon.userlogonfailed2

edr.crowdstrike.cannon.volumesnapshotcreated

edr.crowdstrike.cannon.volumesnapshotcreated

edr.crowdstrike.cannon.volumesnapshotdeleted

edr.crowdstrike.cannon.volumesnapshotdeleted

edr.crowdstrike.cannon.wfpfiltertamperingfilteradded

edr.crowdstrike.cannon.wfpfiltertamperingfilteradded

edr.crowdstrike.cannon.wfpfiltertamperingfilterdeleted

edr.crowdstrike.cannon.wfpfiltertamperingfilterdeleted

edr.crowdstrike.cannon.wmicreateprocess

edr.crowdstrike.cannon.wmicreateprocess

edr.crowdstrike.cannon.wmifilterconsumerbindingetw

edr.crowdstrike.cannon.wmifilterconsumerbindingetw

edr.crowdstrike.cannon.wmiproviderregistrationetw

edr.crowdstrike.cannon.wmiproviderregistrationetw

edr.crowdstrike.cannon.wroteexeandgeneratedserviceevent

edr.crowdstrike.cannon.wroteexeandgeneratedserviceevent

edr.crowdstrike.cannon.zipfilewritten

edr.crowdstrike.cannon.zipfilewritten

CrowdStrike Cannon Basic

edr.crowdstrike.cannonBasic

edr.crowdstrike.cannonBasic

CrowdStrike Falcon Discover

edr.crowdstrike.discover

edr.crowdstrike.discover

edr.crowdstrike.discover.appinfo

edr.crowdstrike.discover.appinfo

edr.crowdstrike.discover.userinfo

edr.crowdstrike.discover.userinfo

CrowdStrike Falcon

edr.crowdstrike.falcon

edr.crowdstrike.falcon

CrowdStrike Falcon FileVantage

edr.crowdstrike.falcon_filevantage.change

edr.crowdstrike.falcon_filevantage.change

CrowdStrike Falcon Spotlight

edr.crowdstrike.spotlight.vulnerabilities

edr.crowdstrike.spotlight.vulnerabilities

CrowdStrike Falcon Streaming

edr.crowdstrike.falconstreamin

edr.crowdstrike.falconstreamin

edr.crowdstrike.falconstreaming.agents

edr.crowdstrike.falconstreaming.agents

edr.crowdstrike.falconstreaming.auth_activity

edr.crowdstrike.falconstreaming.auth_activity

edr.crowdstrike.falconstreaming.behaviors

edr.crowdstrike.falconstreaming.behaviors

edr.crowdstrike.falconstreaming.cspm_ioa_streaming

edr.crowdstrike.falconstreaming.cspm_ioa_streaming

edr.crowdstrike.falconstreaming.cspm_search_streaming

edr.crowdstrike.falconstreaming.cspm_search_streaming

edr.crowdstrike.falconstreaming.customer_ioc

edr.crowdstrike.falconstreaming.customer_ioc

edr.crowdstrike.falconstreaming.detection_summary

edr.crowdstrike.falconstreaming.detection_summary

edr.crowdstrike.falconstreaming.external_api

edr.crowdstrike.falconstreaming.external_api

edr.crowdstrike.falconstreaming.firewall_match

edr.crowdstrike.falconstreaming.firewall_match

edr.crowdstrike.falconstreaming.identity_protection

edr.crowdstrike.falconstreaming.identity_protection

edr.crowdstrike.falconstreaming.idp_detection_summary

edr.crowdstrike.falconstreaming.idp_detection_summary

edr.crowdstrike.falconstreaming.incidentsincident_summary

edr.crowdstrike.falconstreaming.incidentsincident_summary

edr.crowdstrike.falconstreaming.incident_summaryincidents

edr.crowdstrike.falconstreaming.incident_summaryincidents

edr.crowdstrike.falconstreaming.mobile_detection_summary

edr.crowdstrike.falconstreaming.mobile_detection_summary

edr.crowdstrike.falconstreaming.other

edr.crowdstrike.falconstreaming.other

edr.crowdstrike.falconstreaming.recon_notification_summary

edr.crowdstrike.falconstreaming.recon_notification_summary

edr.crowdstrike.falconstreaming.remote_response_session

edr.crowdstrike.falconstreaming.remote_response_session

edr.crowdstrike.falconstreaming.scheduled_report_notification

edr.crowdstrike.falconstreaming.scheduled_report_notification

edr.crowdstrike.falconstreaming.user_activity_detections

edr.crowdstrike.falconstreaming.user_activity_detections

edr.crowdstrike.falconstreaming.user_activity_device_control_groupspolicy

edr.crowdstrike.falconstreaming.user_activity_device_control_groupspolicy

edr.crowdstrike.falconstreaming.user_activity_quarantined_filesdevices

edr.crowdstrike.falconstreaming.user_activity_quarantined_filesdevices

edr.crowdstrike.falconstreaming.user_activity_sensor_update_policygroups

edr.crowdstrike.falconstreaming.user_activity_sensor_update_policygroups

edr.crowdstrike.falconstreaming.user_activity_ip_otherwhitelist

edr.crowdstrike.falconstreaming.user_activity_ip_otherwhitelist

edr.crowdstrike.falconstreaming.reconuser_notificationactivity_summaryother

edr.crowdstrike.falconstreaming.reconuser_notificationactivity_summaryother

edr.crowdstrike.falconstreaming.user_activity_prevention_devicespolicy

edr.crowdstrike.falconstreaming.user_activity_prevention_devicespolicy

edr.crowdstrike.falconstreaming.user_activity_quarantined_detectionsfiles

edr.crowdstrike.falconstreaming.user_activity_quarantined_detectionsfiles

edr.crowdstrike.falconstreaming.user_activity_sensor_ipupdate_whitelistpolicy

edr.crowdstrike.falconstreaming.user_activity_sensor_ipupdate_whitelistpolicy

edr.crowdstrike.falconstreaming.vulnerabilities

edr.crowdstrike.falconstreaming.vulnerabilities

CrowdStrike Falcon Insight

edr.crowdstrike.insight

edr.crowdstrike.insight.aidmaster

edr.crowdstrike.insight.aidmaster

edr.crowdstrike.insight.falconmanagedassets

edr.crowdstrike.insight.falconmanagedassets

edr.crowdstrike.falcon_spotlightinsight.vulnerabilitiesnotmanaged

edr.crowdstrike.falcon_spotlightinsight.vulnerabilitiesnotmanaged

How is the data sent to Devo?

...