File Write Events with Human-Readable File Sizes

The query lists file write events and converts the file size into readable units (KB, MB, GB, or TB), displaying timestamps, host details, filenames, and both raw and formatted file sizes.

CQL · Falcon Next-Gen SIEMCopy query

Loading query…

File_Write_Events_with_Human-Readable_File_Sizes.yml

CrowdStrike

Hunting

Endpoint

Insight

Want this running in your SIEM — with someone on call?

Our Managed SIEM team operates CrowdStrike Falcon Next-Gen SIEM in production, with over 350 battle-tested use cases and 24/7 incident response behind them.

Talk to the SIEM team