[Crowdstrike] Add Falcon Event Streams support for APIActivityAuditEvent by sharad-elastic · Pull Request #21269 · elastic/integrations

sharad-elastic · 2026-09-15T12:48:54Z

Type of change

Enhancement

Proposed commit message

crowdstrike: add falcon event streams support for APIActivityAuditEvent

Map CrowdStrike Falcon APIActivityAuditEvent fields to ECS and 
route them through a dedicated ingest pipeline.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

Collected live events from the CrowdStrike instance and verified the mappings in Elasticsearch.

Related issues

Relates [CrowdStrike] Add support for HashSpreadingEvent and APIActivityAuditEvent #20431

infra-vault-gh-plugin-prod · 2026-09-15T12:48:59Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

github-actions · 2026-09-15T12:50:07Z

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

vera-review-bot · 2026-09-15T12:53:09Z

+  changes:
+    - description: Add support for APIActivityAuditEvent in the Falcon data stream.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/1


Severity: 🔵 Low confidence: high path: packages/crowdstrike/changelog.yml:6

Changelog link uses the placeholder pull number 1; replace it with this PR's URL.

Details

The new 4.10.0 changelog entry links to #1, which is a placeholder rather than the pull request introducing the change (21269). The changelog-link CI check will fail on the mismatch until it is updated.

Recommendation:

Point the link at this pull request.

Suggested change

link: https://github.com/elastic/integrations/pull/1

link: https://github.com/elastic/integrations/pull/21269

🤖 AI-Generated Review | Vera Review Bot - v0.4.1 | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

This should be fixed. It's unclear to me why the CI is green when this is in place; the comment posted indicates a failure, but the gate is open.

cc @mrodm

@efd6 We didn't want to block the CI because of this mismatch. We were not sure if there could be some reason to use another pull request link in the changelog entries.

That's why that for now this mismatch is reported as a comment: #21269 (comment)
but not blocking the CI even if the step fails in Buildkite (it is set as soft_fail in buildkite this step).

So we thought that the author must decide whether or not to update the changelog after the comment is posted.

Thanks @mrodm. In this case, the existing text is clearly a placeholder and the change should be made before merging.

I would think that in general, if the author of a change thinks that the check should not be made, they have the option to set the label to skip the check. Is there a reason that is not enough?

@efd6 That's true I think the label could help in those cases.

We wanted to start conservative and not break CI for unknown/edge cases. Since the changelog-link-check:skip label provides a clear escape hatch, we could change the implementation to fail that step.
Opened issue for this #21587.

elastic-vault-github-plugin-prod · 2026-09-15T13:41:52Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

efd6 · 2026-09-21T23:59:24Z

+  changes:
+    - description: Add support for APIActivityAuditEvent in the Falcon data stream.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/1


This should be fixed. It's unclear to me why the CI is green when this is in place; the comment posted indicates a failure, but the gate is open.

cc @mrodm

efd6 · 2026-09-22T00:01:52Z

To be able to review this properly we really need some documentation indication expected behaviour. Ideally this would be a table explaining what things exist and how they are to be mapped in the original issue and if possible, a link to documentation in the commit message (this may be paywalled, so if that's the case, it is not required).

Added the expected field → ECS mapping table on #20431.

CrowdStrike does not publish a stable public schema for Event Streams APIActivityAuditEvent; the table is derived from live events. I do not have a non-paywalled vendor doc URL to add to the commit message.

elastic-vault-github-plugin-prod · 2026-09-30T08:36:53Z

✅ All changelog entries have the correct PR link.

vera-review-bot · 2026-09-30T08:37:01Z

🟢 No issues across the latest commits 1fe49f9.

⚠️ 1 comment still unresolved from earlier commits — 1 low

🔵 Changelog link uses the placeholder pull number 1 (link)

Review summary

Issues found across earlier commits 911a245 — 2 low

🔵 Changelog link uses the placeholder pull number 1 (link) (Outdated)
🔵 user_agent.original is populated but never parsed (link) (Outdated)

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot - v0.4.2 | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

infra-vault-gh-plugin-prod · 2026-09-30T09:23:28Z

💚 Build Succeeded

Buildkite Build
Commit: 1fe49f9

History

💚 Build #50646 succeeded 5089fef
💔 Build #49702 failed 911a245

cc @sharad-elastic

mergify · 2026-10-11T21:47:08Z

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.

github-actions · 2026-10-12T06:02:09Z

Backport branches

Important

Only active backport branches for packages changed by this PR are shown.

Tick the branches you want to backport to. A backport PR will be opened automatically for each branch you check.

Backport a change when it fixes behavior a branch already has; leave new behavior on main. See when and why to backport if you are unsure.

crowdstrike

backport-crowdstrike-1.52
backport-crowdstrike-1.46

Tip

If a branch above is no longer required, set archived: true in its entry in .backports.yml to stop it appearing here.
If the branch has a known end-of-life date, prefer maintained_until: "YYYY-MM-DD" — it will be excluded automatically once that date passes.

cc @sharad-elastic

elastic-vault-github-plugin-prod · 2026-10-12T06:17:53Z

Package crowdstrike - 4.10.0 containing this change is available at https://epr.elastic.co/package/crowdstrike/4.10.0/

sharad-elastic added 2 commits August 25, 2026 14:27

Add support for APIActivityAuditEvent event type

3f956f2

Merge branch 'main' into crowdstrike-support_api_activity_audit_event

911a245

sharad-elastic self-assigned this Sep 15, 2026

sharad-elastic requested review from a team as code owners September 15, 2026 12:48

sharad-elastic added Integration:crowdstrike CrowdStrike Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Sep 15, 2026

vera-review-bot Bot reviewed Sep 15, 2026

View reviewed changes

qcorporation added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Sep 15, 2026

Update changelog entry

261aa2f

efd6 requested changes Sep 22, 2026

View reviewed changes

resolve review comment and improve tag

5089fef

sharad-elastic requested a review from efd6 September 28, 2026 08:41

qcorporation added the enhancement New feature or request label Sep 28, 2026

efd6 reviewed Sep 29, 2026

View reviewed changes

resolve review comments

1fe49f9

sharad-elastic requested a review from efd6 September 30, 2026 09:46

efd6 approved these changes Oct 11, 2026

View reviewed changes

sharad-elastic merged commit 09d31fa into elastic:main Oct 12, 2026
16 checks passed

	link: https://github.com/elastic/integrations/pull/1
	link: https://github.com/elastic/integrations/pull/21269

Conversation

sharad-elastic commented Sep 15, 2026

Type of change

Proposed commit message

Checklist

Author's Checklist

Related issues

Uh oh!

infra-vault-gh-plugin-prod Bot commented Sep 15, 2026

Uh oh!

github-actions Bot commented Sep 15, 2026

✅ Elastic Docs Style Checker (Vale)

Uh oh!

vera-review-bot Bot Sep 15, 2026

Choose a reason for hiding this comment

Uh oh!

efd6 Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

mrodm Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

efd6 Sep 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mrodm Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented Sep 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Benchmarks report

Uh oh!

efd6 Sep 21, 2026

Choose a reason for hiding this comment

Uh oh!

efd6 Sep 22, 2026

Choose a reason for hiding this comment

Uh oh!

sharad-elastic Sep 28, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

elastic-vault-github-plugin-prod Bot commented Sep 30, 2026

Uh oh!

vera-review-bot Bot commented Sep 30, 2026

Review summary

Uh oh!

infra-vault-gh-plugin-prod Bot commented Sep 30, 2026

💚 Build Succeeded

History

Uh oh!

mergify Bot commented Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Oct 12, 2026

Backport branches

Uh oh!

elastic-vault-github-plugin-prod Bot commented Oct 12, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mrodm Sep 22, 2026 •

edited

Loading

efd6 Sep 22, 2026 •

edited

Loading

mrodm Sep 23, 2026 •

edited

Loading

elastic-vault-github-plugin-prod Bot commented Sep 15, 2026 •

edited

Loading

mergify Bot commented Oct 11, 2026 •

edited

Loading