Fields available in the raw ingest dataset.
Issue-field assignments emitted by the correlation rule. The Description column captures intent — when present, this is what downstream playbooks rely on the field meaning.
| alter vendor_name = "CrowdStrike", product_name = "Falcon Identity Protection"
| filter product = "idp"
// --- compatibility shim: fields not guaranteed on every IDP tenant ---
// Referencing a column that is absent fails XQL validation, which is what
// returns 101704 on pack install. rawJSON is always present, so read them
// from there: real value when the event has it, null when it does not.
| alter
cs_target_account_object_sid = json_extract_scalar(to_json_string(rawJSON), "$.target_account_object_sid"),
cs_idp_policy_rule_name = json_extract_scalar(to_json_string(rawJSON), "$.idp_policy_rule_name"),
cs_idp_policy_rule_action = json_extract_scalar(to_json_string(rawJSON), "$.idp_policy_rule_action"),
cs_idp_policy_rule_trigger = json_extract_scalar(to_json_string(rawJSON), "$.idp_policy_rule_trigger"),
cs_idp_policy_mfa_provider = json_extract_scalar(to_json_string(rawJSON), "$.idp_policy_mfa_provider"),
cs_idp_policy_mfa_factor_type = json_extract_scalar(to_json_string(rawJSON), "$.idp_policy_mfa_factor_type"),
cs_honeytoken_user = json_extract_scalar(to_json_string(rawJSON), "$.honeytoken_user"),
cs_source_ip_asn_organization = json_extract_scalar(to_json_string(rawJSON), "$.source_ip_asn_organization"),
cs_source_ip_isp_domain = json_extract_scalar(to_json_string(rawJSON), "$.source_ip_isp_domain"),
cs_score = json_extract_scalar(to_json_string(rawJSON), "$.score"),
cs_fine_score = json_extract_scalar(to_json_string(rawJSON), "$.fine_score")
| alter originalrawlog = to_json_string(rawJSON)
| alter severity_int_raw = severity
| alter
tactic = if(tactic = "Malware", "Execution", tactic),
mitre_tactic = if(tactic = "Malware", "Execution", tactic),
mitre_tactic_id = tactic_id,
mitre_technique = technique,
mitre_technique_id = technique_id
| alter mitre_ids_str = if(
technique_id != null and technique != null,
concat(technique_id, " - ", technique),
coalesce(technique_id, technique)
)
| alter
hostname = device->hostname,
domain = device->machine_domain,
local_ip = device->local_ip,
external_ip = device->external_ip,
mac_address = device->mac_address,
device_id = device->device_id,
device_ou = device->ou[],
parent_process_name = parent_details->filename,
parent_process_cmd = parent_details->cmdline,
parent_process_path = parent_details->filepath,
parent_process_sha256 = parent_details->sha256,
parent_local_process_id = parent_details->local_process_id,
grandparent_process_name = grandparent_details->filename,
grandparent_process_cmd = grandparent_details->cmdline,
grandparent_process_path = grandparent_details->filepath,
grandparent_process_sha256 = grandparent_details->sha256,
grandparent_local_process_id = grandparent_details->local_process_id
| alter src_account_name = source_account_name,
src_account_upn = source_account_upn,
src_account_sid = source_account_object_sid,
src_host = source_endpoint_host_name,
src_ip = source_endpoint_address_ip4,
src_ip_v6 = source_endpoint_address_ip6,
src_sensor_id = source_endpoint_sensor_id,
dst_account_name = target_account_name,
dst_account_sid = cs_target_account_object_sid,
dst_host = target_endpoint_host_name,
dst_sensor_id = target_endpoint_sensor_id,
idp_logon_domain = logon_domain
| alter dst_ip = arrayindex(regextract(to_json_string(network_accesses), "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"), 0)
| alter user_name = coalesce(user_name, src_account_name),
user_principal = coalesce(user_principal, src_account_upn),
hostname = coalesce(hostname, src_host),
domain = coalesce(domain, idp_logon_domain),
local_ip = coalesce(local_ip, src_ip),
agent_id = coalesce(agent_id, src_sensor_id)
| alter hostname = arrayindex(split(hostname, "."), 0)
| alter device_ou_arr = arraymap(device_ou, replace("@element", "\"", ""))
| alter raw_sam = arrayindex(split(coalesce(user_name, ""), "\\"), -1)
| alter raw_email = coalesce(
if(user_principal contains "@", lowercase(user_principal), null),
if(user_name contains "@", lowercase(user_name), null))
| alter idr_email = raw_email,
idr_upn = user_principal,
idr_display_name = display_name,
idr_sam_account_name = raw_sam,
idr_netbios = null,
idr_sid = coalesce(source_account_object_sid, src_account_sid),
idr_on_prem_sid = coalesce(source_account_object_sid, src_account_sid),
idr_domain_name = coalesce(domain, idp_logon_domain)
| alter email = idr_email,
actor_effective_username = lowercase(coalesce(idr_email, raw_sam, user_name))
| alter cgo_name = if(lowercase(grandparent_process_name) not in ("wininit.exe", "userinit.exe"),
grandparent_process_name,
coalesce(parent_process_name, filename)),
cgo_path = if(lowercase(grandparent_process_name) not in ("wininit.exe", "userinit.exe"),
grandparent_process_path,
coalesce(parent_process_path, filepath)),
cgo_cmd = if(lowercase(grandparent_process_name) not in ("wininit.exe", "userinit.exe"),
grandparent_process_cmd,
coalesce(parent_process_cmd, cmdline))
//| alter dns_queries = dns_requests
//| alter remote_ips = coalesce(dst_ip, network_accesses)
| alter idp_context = concat(
"Source: ", coalesce(src_account_name, "Unknown"),
" @ ", coalesce(src_host, "Unknown"), " (", coalesce(src_ip, "n/a"), ")",
" -> Target: ", coalesce(dst_account_name, "n/a"),
" @ ", coalesce(dst_host, "n/a"),
" | App: ", coalesce(sso_application_identifier, sso_application_uri, "n/a"),
" | Policy: ", coalesce(cs_idp_policy_rule_name, "n/a"),
" (", coalesce(cs_idp_policy_rule_action, "no action"), ")",
" | MFA: ", coalesce(cs_idp_policy_mfa_factor_type, cs_idp_policy_mfa_provider, "n/a")
)
| alter alert_name = concat(
"[Identity] ",
coalesce(actor_effective_username, display_name, hostname, "Unknown"),
" - ",
coalesce(tactic, "Detection"),
": ",
coalesce(technique, name)
)
| alter alert_description = concat(
coalesce(description, name),
" | Host: ", coalesce(hostname, "Unknown"),
" | User: ", coalesce(actor_effective_username, "Unknown"),
" | Severity: ", coalesce(severity_name, "Unknown"),
" | ", idp_context
)
| alter
vendor = vendor_name,
product = product_name,
originalalertid = composite_id,
originalalertname = alert_name,
originalalertsource = "CrowdStrike Falcon Identity Protection",
externallink = falcon_host_link,
alert_description = alert_description,
severity = severity_name,
mitretacticid = mitre_tactic_id,
mitretacticname = mitre_tactic,
mitretechniqueid = mitre_technique_id,
mitretechniquename = mitre_technique,
agent_hostname = hostname,
agent_id = agent_id,
agent_device_domain = domain,
actor_process_image_name = filename,
actor_process_image_path = filepath,
actor_process_image_sha256 = sha256,
actor_process_command_line = cmdline,
actor_process_os_pid = local_process_id,
causality_actor_process_image_name = cgo_name,
causality_actor_process_image_path = cgo_path,
causality_actor_process_image_sha256 = grandparent_process_sha256,
action_file_name = filename,
action_file_path = filepath,
action_file_sha256 = sha256,
action_local_ip = local_ip,
action_local_ip_v6 = src_ip_v6,
//action_remote_ip = remote_ips,
causality_id = aggregate_id,
dst_agent_id_v = dst_sensor_id,
dst_hostname_v = dst_host,
dst_user_v = dst_account_name
| fields
device_id, local_ip, user_name, user_principal, email, raw_email, raw_sam, idr_email, idr_upn, idr_display_name, idr_sam_account_name, idr_netbios, idr_sid, idr_on_prem_sid, idr_domain_name, cmdline, sha256, domain, hostname, agent_id, pattern_disposition_description, pattern_disposition_details, cgo_cmd, cgo_name, cgo_path, template_instance_id, external_ip, falcon_host_link, mac_address, mitre_tactic_id, mitre_tactic, mitre_technique_id, mitre_technique, mitre_ids_str, tactic_id, tactic, technique_id, technique, objective, composite_id, parent_process_cmd, parent_process_name, parent_local_process_id, parent_process_path, parent_process_sha256, grandparent_process_name, grandparent_process_cmd, grandparent_process_path, grandparent_process_sha256, grandparent_local_process_id, device_ou_arr, process_start_time, local_process_id, md5, scenario, severity_name, aggregate_id, indicator_id, alert_name, alert_description, actor_effective_username, files_written, originalrawlog, src_account_name, src_account_upn, src_account_sid, src_host, src_ip, src_ip_v6, src_sensor_id, dst_account_name, dst_account_sid, dst_host, dst_ip, dst_sensor_id, idp_logon_domain, idp_context, sso_application_identifier, sso_application_uri, cs_idp_policy_rule_name, cs_idp_policy_rule_action, cs_idp_policy_rule_trigger, cs_idp_policy_mfa_provider, cs_idp_policy_mfa_factor_type, privileges, added_privileges, cs_honeytoken_user, ldap_search_query_attack, cs_source_ip_asn_organization, cs_source_ip_isp_domain, pattern_disposition, cs_score, cs_fine_score, causality_id, dst_agent_id_v, dst_hostname_v, dst_user_v, *
| alter socfw_event_time = _time,
socfw_insert_time = _insert_time
| alter _time = coalesce(socfw_insert_time, socfw_event_time)