Windows authentication traffic metrics
Displays Windows-collected authentication traffic metrics from your domain controllers, including Kerberos authentications, NTLM authentications, LDAP binds, and LDAP searches per second. These are native Windows performance counters and do not represent traffic inspected by Identity Protection - they provide baseline visibility into overall domain controller activity.
CQL · Falcon Next-Gen SIEMCopy query
#repo=base_sensor #event_simpleName="IdpDcPerfReport"
| aid=?SelectedAid
| IdpPerfCounterAvg:= IdpPerfCounterSum / IdpPerfSampleCount
| timeChart(span=15m, function=[avg("IdpPerfCounterAvg")], series=IdpPerfCounterPath)windows_authentication_traffic_metrics.yml
CrowdStrike
Monitoring
Identity
Identity
2025-08-26
2025-10-30
