CrowdStrike Falcon Shield¶
About¶
CrowdStrike Falcon Shield is a SaaS security solution that provides visibility and control over SaaS applications, identities, misconfigurations, and threats. It helps organizations harden SaaS environments, detect risky behavior, and protect human, non-human, and AI-agent identities from SaaS-based attacks
Product Details¶
Vendor URL: CrowdStrike Falcon Shield
Product Type: SaaS Security
Product Tier: Tier II
Integration Method: API
Log Guide: N/A
Parser Details¶
Log Format: JSON
Expected Normalization Rate: Near 100%
Data Label: CROWDSTRIKE_FALCON_SHIELD
UDM Fields (list of all UDM fields leveraged in the Parser):
| Log File Field | UDM Field |
|---|---|
| data.account_id | security_result.detection_fields |
| data.id | metadata.product_log_id |
| data.source | security_result.detection_fields |
| data.source_id | security_result.rule_id |
| description | security_result.description |
| timestamp | metadata.event_timestamp |
| alert_type | metadata.product_event_type |
| is_archived | security_result.detection_fields |
| security_check_api_link | additional.fields |
| data.integration.id | target.resource.product_object_id |
| data.integration.name | target.application |
| data.integration.alias | target.resource.name |
| affected_diff | about.user.userid / about.url / about.user.email_addresses / about labels |
| new_affected_count | security_result.detection_fields |
| api_link | additional.fields |
Product Event Types¶
| Event | UDM Event Classification |
|---|---|
| all | GENERIC_EVENT |
Log Sample¶
{"event_type": "ALERT", "data": {"account_id": "0123456789abcdef01234567", "id": "89abcdef0123456789abcdef", "source": "security_checks", "source_id": "fedcba9876543210fedcba98", "description": "Security check \"Site Content Sensitivity Classification\" affected count changed from 127 to 128", "timestamp": "2026-07-28T05:43:00Z", "alert_type": "Security Check Degraded", "is_archived": false, "user_who_archived": null, "security_check_api_link": "https://api.example.com/v1/accounts/0123456789abcdef01234567/security_checks/fedcba9876543210fedcba98", "integration": {"id": "1234567890abcdef12345678", "name": "SharePoint + OneDrive", "alias": "Example SharePoint"}, "affected_diff": ["https://contoso.sharepoint.example.com/sites/ExampleLeadership"], "new_affected_count": 1, "api_link": "https://api.example.com/saas-security/entities/checks/v3?id=fedcba9876543210fedcba98"}}
Sample Parsing¶
metadata.event_timetsamp = "2026-07-28T05:43:00Z"
metadata.event_type = "GENERIC_EVENT"
metadata.product_log_id = "89abcdef0123456789abcdef"
metadata.vendor_name = "Crowdstrike"
metadata.product_name = "Falcon Shield"
metadata.product_event_type = "Security Check Degraded"
metadata.url_back_to_product = "https://falcon.us-2.crowdstrike.com/shield/security_checks/all?exposure=<data.source_id>&exposureTab=overview"(Dynamically populated with data.source_id)
target.appplication = "SharePoint + OneDrive"
target.resource.name = "Example SharePoint"
target.resource.product_object_id = "1234567890abcdef12345678"
about.url = "https://contoso.sharepoint.example.com/sites/ExampleLeadership"
about.resource.name = "https://contoso.sharepoint.example.com/sites/ExampleLeadership"
security_result.rule_id = "fedcba9876543210fedcba98"
security_result.alert_state = "ALERTING"
security_result.description = "Security check \"Site Content Sensitivity Classification\" affected count changed from 127 to 128"
security_result.detection_fields["new_affected_count"] = "1"
security_result.detection_fields["source"] = "security_checks"
security_result.detection_fields["is_archived"] = "false"
security_result.detection_fields["account_id"] = "0123456789abcdef01234567"
additional.fields["api_link"] = "https://api.example.com/saas-security/entities/checks/v3?id=fedcba9876543210fedcba98"
additional.fields["security_check_api_link"] = ""https://api.example.com/v1/accounts/0123456789abcdef01234567/security_checks/fedcba9876543210fedcba98"