falcon

Expression

product = falcon

Fields

Field	Core	Detection	Informational
web_content_type			✓
fallback_user_name
user	✓	✓
aid			✓
cid			✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
alert-trigger	indicator
	file_path	Legacy			✓
	grandparent_command_line
	rooting
	parent_process_command_line
	falcon_host_link
	kill_parent
	kill_process
	domain_user_name
	pattern_disposition_description
	critical_process_disabled
	process_guid
	policy_disabled
	process_name	Legacy		✓
	alert_id	Legacy			✓
	hash_md5
	image_file_name
	sensor_only
	dest_port	Legacy		✓
	process_blocked
	app
	registry_operation_blocked
	bootup_safeguard_enabled
	process_command_line
	src_host	Legacy	✓	✓
	inddet_mask
	additional_info
	dest_ip	Legacy	✓	✓
	domain
	event_name
	process_path	Legacy		✓
	aid
	process_id
	quarantine_machine
	detect
	fs_operation_blocked
	quarantine_file
	src_ip	Legacy	✓	✓
	sensor_id
	operation_blocked
	event_code
	kill_sub_process
	new_hash
	os
	file_name	Legacy	✓
	file_dir	Legacy			✓
	target
	hash_sha256
	src_port	Legacy			✓
	file_ext
	parent_image_filename
	old_hash
	bytes	Legacy		✓
	grandparent_image_filename
	user_sid
	dest_host	Legacy		✓
	parent_process_guid
	user	Legacy		✓
app-activity	app	Default			✓
	src_ip	Default		✓
	resource	Default			✓
	additional_info	Default			✓
	domain	Default			✓
	domain_user_name
	user	Default		✓
	object	Default			✓
app-login	src_ip	Default		✓
	activity_details	Default			✓
	event_name	Default			✓
	session_id	Default			✓
configuration-modify	domain
	domain_user_name
	operation
	user
	object
dns-request	file_name
	alert_severity
	aip
	src_host	Legacy	✓	✓
	protocol
	process_guid
	dns_response
	additional_info
	event_code
	domain
	hash_md5
	category
	alert_name
endpoint-login	process_id	Default			✓
	file_path	Default			✓
	falcon_host_link	Default			✓
	file_name	Default			✓
	file_dir	Default			✓
	aip	Default			✓
	session_id	Default			✓
	process_command_line	Default			✓
	src_ip	Default		✓
	hash_sha256	Default			✓
	auth_package	Default			✓
	file_ext	Default			✓
	process_guid	Default			✓
	old_hash	Default			✓
	event_code	Default			✓
	bytes	Default			✓
	hash_md5	Default			✓
	user_sid	Default			✓
	event_name	Default			✓
	auth_server	Default			✓
file-delete	process_id
	access	Legacy		✓
	os
	falcon_host_link
	session_id
	src_host	Legacy		✓
	process_command_line
	src_ip
	hash_sha256
	process_guid
	old_hash
	bytes
	event_code
	alert_id
	hash_md5
	user_sid
	event_name
	alert_name
file-download	src_port
	hash_sha256
	process_guid
	old_hash
	event_code
	dest_ip
	event_name
	src_host	Legacy			✓
	new_hash
file-read	process_id
	access	Legacy		✓
	falcon_host_link
	alert_severity
	src_ip
	protocol
	process_guid
	event_code
	alert_id
	hash_md5
	dest_port
	os
	session_id
	src_host	Legacy		✓
	process_command_line
	src_port
	hash_sha256
	additional_info
	old_hash
	bytes	Legacy			✓
	domain
	dest_ip
	user_sid
	event_name
	category
	alert_name
	object
file-write	process_id
	access	Legacy		✓
	falcon_host_link
	alert_severity
	src_ip
	protocol
	process_guid
	file_type	Legacy			✓
	event_code
	alert_id
	hash_md5
	dest_port
	new_hash
	device_id	Legacy		✓
	os
	session_id
	src_host
	process_command_line
	src_port
	hash_sha256
	additional_info
	old_hash
	bytes	Legacy		✓
	domain
	dest_ip
	user_sid
	event_name
	category
	alert_name
group-member-add	src_ip
	domain	Legacy			✓
	domain_user_name
	user	Legacy	✓	✓
	operation
network-traffic	process_guid	Default			✓
	additional_info	Default			✓
	file_name	Default			✓
	event_code	Default			✓
	process_name	Default			✓
	domain	Default			✓
	alert_severity	Default			✓
	hash_md5	Default			✓
	src_host	Default		✓
	category	Default			✓
	alert_name	Default			✓
	direction	Default			✓
peripheral_storage-insert	process_id
	file_path
	device_product				✓
	file_name
	activity_details
	file_dir
	device_description				✓
	src_ip
	file_ext
	event_code
	device_pid				✓
	vendor_id
	alert_id
	device_class				✓
	device_vendor				✓
	device_vid				✓
	operation
peripheral_storage-remove	file_path
	device_product				✓
	file_name	Legacy	✓
	activity_details
	file_dir
	device_description				✓
	src_ip
	file_ext
	event_code	Legacy			✓
	device_pid				✓
	alert_id
	device_class				✓
	device_vendor				✓
	device_vid				✓
	operation
process-create	file_path	Default			✓
	os	Default			✓
	falcon_host_link	Default			✓
	file_name	Default			✓
	service_name	Default			✓
	file_dir	Default			✓
	session_id	Default			✓
	process_command_line	Default			✓
	hash_sha256	Default			✓
	src_ip	Default		✓
	log_severity	Default			✓
	process_guid	Default			✓
	file_ext	Default			✓
	grandparent_process_path	Default			✓
	additional_info	Default			✓
	old_hash	Default			✓
	event_code	Default			✓
	bytes	Default			✓
	dest_ip	Default		✓
	hash_md5	Default			✓
	user_sid	Default			✓
	parent_process_guid	Default			✓
scheduled_task-create	src_ip
	file_path
	file_ext
	event_code	Legacy			✓
	file_name
	file_dir
user-create	src_ip
	app
	domain	Legacy			✓
	event_name
	domain_user_name
	user	Legacy	✓	✓
	operation
user-delete	src_ip
	app
	domain	Legacy			✓
	event_name
	domain_user_name
	user	Legacy	✓	✓
	operation
user-modify	src_ip
	app
	domain	Legacy			✓
	event_name
	domain_user_name
	user	Legacy	✓
	operation
user-role-assign	src_ip	Default		✓
	app	Default			✓
	domain	Default			✓
	event_name	Default			✓
	domain_user_name
	user	Default		✓
	operation	Default			✓
user-role-revoke	src_ip	Default		✓
	app	Default			✓
	domain	Default			✓
	event_name	Default			✓
	domain_user_name
	user	Default		✓
	operation	Default			✓