Queries for the CrowdStrikeAuditEvents table

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Get sample of CrowdStrike Audit Event logs

Get sample of CrowdStrike Audit Event logs

CrowdStrikeAuditEvents
 | take 10

Get CrowdStrike events by type

Get CrowdStrike events by type

CrowdStrikeAuditEvents
 | where EventType == "EppDetectionSummaryEvent"
 | take 10