Follow For a targeted pull, run your query in Falcon’s Advanced Event Search and export the results as JSON. For bulk raw telemetry, Falcon Data Replicator (FDR) delivers your events to an S3 bucket as gzipped JSON, one event per line. Keep in mind what you’re getting: Falcon’s own sensor telemetry (process, network, DNS, logon events), not the hosts’ original Windows or Linux logs.
Falcon telemetry is some of the richest endpoint data a SOC has, and it’s often the first thing an IR partner asks for. Prime Core has 23,742 detection rules for CrowdStrike data, mapped to 674 MITRE ATT&CK techniques. Below is how to get it out, sanitize it, and investigate it for free in LogTotal.
Before you start
Access. Event search needs a Falcon role that allows it. FDR needs its own subscription, plus an API client with FDR scope; CrowdStrike gives you the bucket, queue and credentials.
Retention. How far back event data goes depends on your subscription, often days to a few months. Check before you promise anyone history.
Event names. Falcon telemetry is organized by event_simpleName. The ones you’ll use most: ProcessRollup2 (process start), NetworkConnectIP4, DnsRequest, UserLogon. Knowing them makes queries much faster to write.
CrowdStrike’s documentation sits behind the Falcon login. This guide is based on it, plus the public FalconPy and FDR projects, checked October 2026.
Option 1: Advanced Event Search
Scope the query tightly, and don’t reduce it with table() before exporting, because that drops fields:
#event_simpleName=ProcessRollup2 ComputerName=WS-042
Set the time range, run the search, then export the results as JSON or CSV. If CSV is selected, specify in ‘Fields to export’ choose ‘Select all.
Option 2: Falcon Data Replicator (bulk)
FDR is the route for volume. CrowdStrike writes batches of gzipped JSON files to an S3 bucket and announces each new batch on an SQS queue. For continuous collection, consume the queue (CrowdStrike publishes a sample consumer). For a one-off, list the bucket, pick the batches covering your window, and download them:
export AWS_ACCESS_KEY_ID='<FDR access key>'
export AWS_SECRET_ACCESS_KEY='<FDR secret>'
aws s3 ls s3://<fdr-bucket>/<prefix>/ --recursive | less
aws s3 cp s3://<fdr-bucket>/<prefix>/<batch>/ ./fdr/ --recursive
Then filter to the host you care about, by its agent ID:
zcat ./fdr/*.gz | jq -c 'select(.aid == "<agent-id>")' > ws042_fdr.jsonl
Each line is one event. FDR volume adds up fast, so filter by aid and event_simpleName before you upload.
Step 3: Upload, sanitize and review in LogTotal
- Upload. Open logtotal.com and drop in the .jsonl file.
- Sanitize.
- Review.
When it goes wrong
| Symptom | Likely cause | Fix |
|---|---|---|
| No export option, or results are capped | Role permissions or a UI limit | Check your role; split the time range; use FDR for volume |
| Nothing older than a certain date | Subscription retention | Check FDR archives or your SIEM |
| AccessDenied on the FDR bucket | Credentials rotated, or FDR not enabled | Get current FDR credentials |
| Fields you expected are missing | table() trimmed them | Export without table() |
| FDR files are huge | No filtering | Filter by aid and event_simpleName |
FAQ
Can I get Windows Event Logs out of Falcon?
Not from the sensor telemetry: Falcon doesn’t collect raw Windows event logs by default. Export them from the host
What about detections and alerts?
Those are available through the Falcon API (FalconPy makes it easy), but they’re alerts, not raw telemetry. For LogTotal, export the events behind them.
