Enriched Process Tree Association Events
The query filters for AssociateTreeIdWithRoot events, joins them with detection-pattern metadata from a CSV file, and outputs key fields like timestamp, host, pattern details and severity for analysis. In short, it enriches process-tree association events with contextual detection information.
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=AssociateTreeIdWithRoot
| PatternId =~ match(file="falcon/investigate/detect_patterns.csv", column=PatternId, strict=false)
| select([@timestamp, aid, ComputerName, PatternId,name,scenario,scenarioFriendly,description,severity,show_in_ui,killchain_stage,tactic,technique,objective,pattern_updated])AssociateTreeIdWithRoot
This event is generated when there is a detection in the sensor. This event has a data field called PatternId that contains a pattern ID. Pattern IDs correspond to a detection.
AssociateTreeIdWithRoot_to_Pattern_Details.yml
CrowdStrike
Detection
Endpoint
Insight
2025-10-30
2025-10-30
