Fields available in the raw ingest dataset.
Issue-field assignments emitted by the correlation rule. The Description column captures intent — when present, this is what downstream playbooks rely on the field meaning.
| filter product = "saas-security"
| alter vendor_name = "CrowdStrike", product_name = "Falcon SaaS"
// --- compatibility shim: fields not guaranteed on every SaaS tenant ---
// Referencing a column that is absent fails XQL validation, which is what
// returns 101704 on pack install. A tenant that has never ingested
// product="saas-security" has none of these columns in the dataset schema.
// rawJSON is always present, so read them from there and alias back to the
// canonical names: real value when the event has it, null when it does not.
| alter
cs_user_names = json_extract_array(to_json_string(rawJSON), "$.user_names"),
cs_event_summary = json_extract_scalar(to_json_string(rawJSON), "$.event_summary"),
cs_category = json_extract_scalar(to_json_string(rawJSON), "$.category"),
cs_asn = json_extract_scalar(to_json_string(rawJSON), "$.asn"),
cs_asn_name = json_extract_scalar(to_json_string(rawJSON), "$.asn_name"),
cs_country = json_extract_scalar(to_json_string(rawJSON), "$.country"),
cs_correlation_rule_id = json_extract_scalar(to_json_string(rawJSON), "$.correlation_rule_id")
| alter
user_names = cs_user_names,
event_summary = cs_event_summary,
category = cs_category,
asn = cs_asn,
asn_name = cs_asn_name,
country = cs_country,
correlation_rule_id = cs_correlation_rule_id
// --- end compatibility shim ---
| filter display_name not in ("Anonymized IP")
| alter alert_name = display_name
| alter originalrawlog = to_json_string(rawJSON)
| alter originalalertsource = "CrowdStrike Falcon SaaS Security"
| alter mitre_json = json_extract_array(to_json_string(mitre_attack), "$")
| alter mitre_tech_ids = arraymap(mitre_json, json_extract_scalar("@element", "$.technique_id"))
| alter mitre_tech_names = arraymap(mitre_json, json_extract_scalar("@element", "$.technique"))
| alter mitre_tactic_ids = arraymap(mitre_json, json_extract_scalar("@element", "$.tactic_id"))
| alter mitre_tactic_names = arraymap(mitre_json, json_extract_scalar("@element", "$.tactic"))
| alter mitre_ids_str = arraystring(arraydistinct(mitre_tech_ids), ",")
| alter mitre_tech_name_str = arraystring(arraydistinct(mitre_tech_names), ",")
| alter mitre_tactic_id = arrayindex(arraydistinct(mitre_tactic_ids), 0)
| alter mitre_tactic = arrayindex(arraydistinct(mitre_tactic_names), 0)
| alter tmp_user_names = json_extract_array(to_json_string(user_names), "$")
| alter tmp_user_arr0 = arrayindex(tmp_user_names, 0)
| alter tmp_user_quoted = arrayindex(regextract(coalesce(event_summary, description, ""), "(?i)\buser\s+\"([^\"]+)\""), 0)
| alter tmp_user_email = arrayindex(regextract(coalesce(event_summary, description, ""), "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}"), 0)
| alter tmp_user_token = arrayindex(regextract(coalesce(event_summary, description, ""), "(?i)\buser\s+([A-Za-z0-9._%+@-]+)"), 0)
| alter user_name = coalesce(user_name, tmp_user_arr0, tmp_user_quoted, tmp_user_email, tmp_user_token)
| alter crowdstrike_original_user_name = user_name
| alter crowdstrike_original_display_name = display_name
| alter actor_effective_username = user_name
| alter local_ip = arrayindex(regextract(coalesce(event_summary, description, ""), "\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b"), 0)
| alter idr_email = if(user_name contains "@", lowercase(user_name), null),
idr_upn = if(user_name contains "@", user_name, null),
idr_sam_account_name = if(user_name contains "@", null, user_name),
idr_display_name = null,
idr_domain_name = null,
idr_netbios = null,
idr_sid = null,
idr_on_prem_sid = null
| alter display_name = coalesce(idr_display_name, idr_sam_account_name, user_name),
user_principal = idr_upn
| alter email = idr_email
| alter actor_effective_username = lowercase(coalesce(idr_email, idr_upn, idr_netbios, actor_effective_username))
| alter description = coalesce(event_summary, description, concat(alert_name, ". See external link for details."))
| alter alert_name = concat(
"[SaaS] ",
coalesce(actor_effective_username, user_name, "Unknown"),
" - ",
coalesce(mitre_tactic, category, "SaaS Activity"),
": ",
coalesce(display_name, name, "Detection")
)