File Write Events with Human-Readable File Sizes

The query lists file write events and converts the file size into readable units (KB, MB, GB, or TB), displaying timestamps, host details, filenames, and both raw and formatted file sizes.

CQL · Falcon Next-Gen SIEMCopy query

#event_simpleName=/FileWritten$/ 
| case {
    Size>=1099511627776 | CommonSize:=unit:convert(Size, to=T) | format("%,.2f TB",field=["CommonSize"], as="CommonSize");
    Size>=1073741824 | CommonSize:=unit:convert(Size, to=G) | format("%,.2f GB",field=["CommonSize"], as="CommonSize");
    Size>=1048576| CommonSize:=unit:convert(Size, to=M) | format("%,.2f MB",field=["CommonSize"], as="CommonSize");
    Size>1024 | CommonSize:=unit:convert(Size, to=k) | format("%,.3f KB",field=["CommonSize"], as="CommonSize");
    * | CommonSize:=format("%,.0f Bytes",field=["Size"]);
}
| table([@timestamp, aid, ComputerName, FileName, Size, CommonSize])

Reference: GitHub CrowdStrike/logscale-community

File_Write_Events_with_Human-Readable_File_Sizes.yml

CrowdStrike

Hunting

Endpoint

Insight

2025-10-30

File Write Events with Human-Readable File Sizes

Get this query running in your SIEM, with someone on call.