CrowdStrike Attribute Reference

Table of Contents

CrowdStrike Attribute Reference

This reference lists the attributes that Device Security collects from CrowdStrike, their names as stored in Device Security, and the Device Security fields they map to.

When Device Security integrates with CrowdStrike Falcon, it imports endpoint protection data to enrich the device inventory. The attributes in this reference cover device identification, OS, and agent status information from the CrowdStrike Falcon platform.

The third-party attribute name in Device Security refers to the attribute name as it appears in the Assets Inventory table and in Query Engine. This follows the format of third-party-name.attribute-name. When viewing the attribute name in the Assets Inventory table column selector or on a Device Details page, where the third-party name can be found as a header for the attributes section, then the third-party name is removed from the attribute name.

For example, micrsoft_defender_xdr.macAddress would appear in the Query Builder and in the Assets Inventory table, but under Device DetailsAttributesIntegration Specific AttributesMicrosoft Defender, the attribute would appear as macAddress.

Device Attributes

Device Security collects device attributes from CrowdStrike. The following table lists each CrowdStrike attribute, its name as stored in Device Security, and the Device Security field it maps to (if applicable).

CrowdStrike Attribute	Device Security Attribute Name	Device Security Common Attribute*	Description
machine_domain	crowdstrike_falcon.machine_domain	AD Domain	Machine domain
last_login_user	crowdstrike_falcon.last_login_user	AD Username	Last login user
"CrowdStrike"	—	Endpoint Protection Vendor	"crowd strike"
first_seen	crowdstrike_falcon.first_seen	First Seen	First seen
hostname	crowdstrike_falcon.hostname	hostname	Name of the device
ipv4_address	—	IP Address	Ipv4 address
last_seen	crowdstrike_falcon.last_seen	Last Activity	Last seen
mac_address	crowdstrike_falcon.mac_address	MAC Address; id	MAC address
instance	—	network_segment_id	Instance
os_build	crowdstrike_falcon.os_build	OS Build Number	OS build
os_version	crowdstrike_falcon.os_version	OS Version	OS version
external_ip	crowdstrike_falcon.external_ip	public_ip_address	External IP
system_product_name	crowdstrike_falcon.system_product_name	raw_model	System product name
os_product_name	crowdstrike_falcon.os_product_name	raw_os; OS Edition	Os product name
serial_number	crowdstrike_falcon.serial_number	Serial Number	Serial number
system_manufacturer	crowdstrike_falcon.system_manufacturer	Vendor	System manufacturer
agent_load_flags	crowdstrike_falcon.agent_load_flags	—	Agent load flags
agent_local_time	crowdstrike_falcon.agent_local_time	—	Agent local time
agent_version	crowdstrike_falcon.agent_version	—	Agent version
bios_manufacturer	crowdstrike_falcon.bios_manufacturer	—	Bios manufacturer
bios_version	crowdstrike_falcon.bios_version	—	Bios version
build_number	crowdstrike_falcon.build_number	—	Build number
chassis_type	crowdstrike_falcon.chassis_type	—	Chassis type
chassis_type_desc	crowdstrike_falcon.chassis_type_desc	—	Chassis type desc
cid	crowdstrike_falcon.cid	—	CID
config_id_base	crowdstrike_falcon.config_id_base	—	Config ID base
config_id_build	crowdstrike_falcon.config_id_platform	—	Config ID build
connection_ip	crowdstrike_falcon.connection_ip	—	Connection IP
connection_mac_address	crowdstrike_falcon.connection_mac_address	—	Connection MAC address
cpu_signature	crowdstrike_falcon.cpu_signature	—	CPU signature
cpu_vendor	crowdstrike_falcon.cpu_vendor	—	CPU vendor
default_gateway_ip	crowdstrike_falcon.default_gateway_ip	—	Default gateway IP
device_id	crowdstrike_falcon.device_id	—	Device ID
device_policies.content-update.applied	crowdstrike_falcon.device_policies.content_update.applied	—	Applied
content-update	crowdstrike_falcon.device_policies.content_update.applied_date	—	Content update
device_policies.content-update.assigned_date	crowdstrike_falcon.device_policies.content_update.assigned_date	—	Assigned date
device_policies.content-update.policy_id	crowdstrike_falcon.device_policies.content_update.policy_id	—	Policy ID
device_policies.content-update.policy_type	crowdstrike_falcon.device_policies.content_update.policy_type	—	Policy type
device_policies.content-update.settings_hash	crowdstrike_falcon.device_policies.content_update.settings_hash	—	Settings hash
device_policies.device_control.applied	crowdstrike_falcon.device_policies.device_control.applied	—	Applied
device_policies.device_control.applied_date	crowdstrike_falcon.device_policies.device_control.applied_date	—	Applied date
device_policies.device_control.assigned_date	crowdstrike_falcon.device_policies.device_control.assigned_date	—	Assigned date
device_policies.device_control.policy_id	crowdstrike_falcon.device_policies.device_control.policy_id	—	Policy ID
device_policies.device_control.policy_type	crowdstrike_falcon.device_policies.device_control.policy_type	—	Policy type
device_policies.device_control.settings_hash	crowdstrike_falcon.device_policies.device_control.settings_hash	—	Settings hash
device_policies.firewall.applied	crowdstrike_falcon.device_policies.firewall.applied	—	Applied
device_policies.firewall.applied_date	crowdstrike_falcon.device_policies.firewall.applied_date	—	Applied date
device_policies.firewall.assigned_date	crowdstrike_falcon.device_policies.firewall.assigned_date	—	Assigned date
device_policies.firewall.policy_id	crowdstrike_falcon.device_policies.firewall.policy_id	—	Policy ID
device_policies.firewall.policy_type	crowdstrike_falcon.device_policies.firewall.policy_type	—	Policy type
device_policies.firewall.rule_set_id	crowdstrike_falcon.device_policies.firewall.rule_set_id	—	Rule set ID
device_policies.firewall.settings_hash	crowdstrike_falcon.device_policies.firewall.settings_hash	—	Settings hash
device_policies.global_config.applied	crowdstrike_falcon.device_policies.global_config.applied	—	Applied
device_policies.global_config.applied_date	crowdstrike_falcon.device_policies.global_config.applied_date	—	Applied date
device_policies.global_config.assigned_date	crowdstrike_falcon.device_policies.global_config.assigned_date	—	Assigned date
device_policies.global_config.policy_id	crowdstrike_falcon.device_policies.global_config.policy_id	—	Policy ID
device_policies.global_config.policy_type	crowdstrike_falcon.device_policies.global_config.policy_type	—	Policy type
device_policies.global_config.settings_hash	crowdstrike_falcon.device_policies.global_config.settings_hash	—	Settings hash
device_policies.host-retention.applied	crowdstrike_falcon.device_policies.host_retention.applied	—	Applied
device_policies.host-retention.applied_date	crowdstrike_falcon.device_policies.host_retention.applied_date	—	Applied date
device_policies.host-retention.assigned_date	crowdstrike_falcon.device_policies.host_retention.assigned_date	—	Assigned date
device_policies.host-retention.policy_id	crowdstrike_falcon.device_policies.host_retention.policy_id	—	Policy ID
device_policies.host-retention.policy_type	crowdstrike_falcon.device_policies.host_retention.policy_type	—	Policy type
device_policies.host-retention.settings_hash	crowdstrike_falcon.device_policies.host_retention.settings_hash	—	Settings hash
device_policies.prevention.applied	crowdstrike_falcon.device_policies.prevention.applied	—	Applied
device_policies.prevention.applied_date	crowdstrike_falcon.device_policies.prevention.applied_date	—	Applied date
device_policies.prevention.assigned_date	crowdstrike_falcon.device_policies.prevention.assigned_date	—	Assigned date
device_policies.prevention.policy_id	crowdstrike_falcon.device_policies.prevention.policy_id	—	Policy ID
device_policies.prevention.policy_type	crowdstrike_falcon.device_policies.prevention.policy_type	—	Policy type
device_policies.prevention.rule_groups	crowdstrike_falcon.device_policies.prevention.rule_groups	—	Rule groups
device_policies.prevention.settings_hash	crowdstrike_falcon.device_policies.prevention.settings_hash	—	Settings hash
device_policies.remote_response.applied	crowdstrike_falcon.device_policies.remote_response.applied	—	Applied
device_policies.remote_response.applied_date	crowdstrike_falcon.device_policies.remote_response.applied_date	—	Applied date
device_policies.remote_response.assigned_date	crowdstrike_falcon.device_policies.remote_response.assigned_date	—	Assigned date
device_policies.remote_response.policy_id	crowdstrike_falcon.device_policies.remote_response.policy_id	—	Policy ID
device_policies.remote_response.policy_type	crowdstrike_falcon.device_policies.remote_response.policy_type	—	Policy type
device_policies.remote_response.settings_hash	crowdstrike_falcon.device_policies.remote_response.settings_hash	—	Settings hash
device_policies.sensor_update.applied	crowdstrike_falcon.device_policies.sensor_update.applied	—	Applied
device_policies.sensor_update.applied_date	crowdstrike_falcon.device_policies.sensor_update.applied_date	—	Applied date
device_policies.sensor_update.assigned_date	crowdstrike_falcon.device_policies.sensor_update.assigned_date	—	Assigned date
device_policies.sensor_update.policy_id	crowdstrike_falcon.device_policies.sensor_update.policy_id	—	Policy ID
device_policies.sensor_update.policy_type	crowdstrike_falcon.device_policies.sensor_update.policy_type	—	Policy type
device_policies.sensor_update.settings_hash	crowdstrike_falcon.device_policies.sensor_update.settings_hash	—	Settings hash
device_policies.sensor_update.uninstall_protection	crowdstrike_falcon.device_policies.sensor_update.uninstall_protection	—	Uninstall protection
device_policies.system-tray.applied	crowdstrike_falcon.device_policies.system_tray.applied	—	Applied
device_policies.system-tray.applied_date	crowdstrike_falcon.device_policies.system_tray.applied_date	—	Applied date
device_policies.system-tray.assigned_date	crowdstrike_falcon.device_policies.system_tray.assigned_date	—	Assigned date
device_policies.system-tray.policy_id	crowdstrike_falcon.device_policies.system_tray.policy_id	—	Policy ID
device_policies.system-tray.policy_type	crowdstrike_falcon.device_policies.system_tray.policy_type	—	Policy type
device_policies.system-tray.settings_hash	crowdstrike_falcon.device_policies.system_tray.settings_hash	—	Settings hash
filesystem_containment_status	crowdstrike_falcon.filesystem_containment_status	—	Filesystem containment status
group_hash	crowdstrike_falcon.group_hash	—	Group hash
kernel_version	crowdstrike_falcon.kernel_version	—	Kernel version
last_login_timestamp	crowdstrike_falcon.last_login_timestamp	—	Last login timestamp
last_login_user_sid	crowdstrike_falcon.last_login_user_sid	—	Last login user sid
last_reboot	crowdstrike_falcon.last_reboot	—	Last reboot
local_ip	crowdstrike_falcon.local_ip	—	Local IP
major_version	crowdstrike_falcon.major_version	—	Major version
meta.version	crowdstrike_falcon.meta.version	—	Version
meta.version_string	crowdstrike_falcon.meta.version_string	—	Version string
minor_version	crowdstrike_falcon.minor_version	—	Minor version
modified_timestamp	crowdstrike_falcon.modified_timestamp	—	Modified timestamp
platform_id	crowdstrike_falcon.platform_id	—	Platform ID
platform_name	crowdstrike_falcon.platform_name	—	Platform name
pointer_size	crowdstrike_falcon.pointer_size	—	Pointer size
policies	crowdstrike_falcon.policies	—	Policies
product_type	crowdstrike_falcon.product_type	—	Product type
product_type_desc	crowdstrike_falcon.product_type_desc	—	Product type desc
provision_status	crowdstrike_falcon.provision_status	—	Provision status
reduced_functionality_mode	crowdstrike_falcon.reduced_functionality_mode	—	Reduced functionality mode
rtr_state	crowdstrike_falcon.rtr_state	—	Rtr state
service_pack_minor	crowdstrike_falcon.service_pack_minor	—	Service pack minor
site_name	crowdstrike_falcon.site_name	—	Site name
status	crowdstrike_falcon.status	—	Status of the device
tags	crowdstrike_falcon.tags	—	Tags

* Only some attributes map to a Device Security Common Attribute.

Cortex XDR Attribute Reference

ExtremeCloud IQ NAC Attribute Reference

Device Security Docs

CrowdStrike Attribute Reference

Device Security Docs

CrowdStrike Attribute Reference

Device Attributes

Activation & Onboarding

Next-Generation Firewalls

SASE