New API Keys within the Falcon Platform
This query provides a list of newly created API Keys, including relevant details such as Client Name and Client ID.
CQL · Falcon Next-Gen SIEMCopy query
#event.dataset = falcon.cloud
| OperationName = CreateAPIClient
| user.id = *
| "Client Name" := rename(Attributes.name)
| "Client ID" := rename(Attributes.APIClientID)
| "Scope(s)" := rename("Attributes.scope(s)")
| table([timestamp,"Client Name","Client ID", "Scope(s)",OperationName,Success,Source,SourceIp,UserId])API_key_creation.yml
ByteRay
Monitoring
Other
2025-10-29
2025-10-29
