Elastic medium stable kql

CrowdStrike External Alerts

Generates a detection alert for each CrowdStrike alert written to the configured indices. Enabling this rule allows you to immediately begin investigating CrowdStrike alerts in the app.

View Source

Detection Logic

event.kind: alert and data_stream.dataset: crowdstrike.alert

Field Validations

Loading…

Comments (0)

Loading comments...