Which document can reference any searchable event and its description?

In the CrowdStrike Falcon ecosystem, the Events Full Reference , commonly referred to as the Events Data Dictionary , is the foundational documentation for any analyst performing raw telemetry analysis. This document serves as the definitive encyclopedia for every event type (such as ProcessRollup2, NetworkConnectIP4, or DnsRequest) and every individual field (such as aid, TargetProcessId, or CommandLine) captured by the Falcon sensor.

When a hunter is crafting complex queries in Event Search , the Data Dictionary provides the necessary context to understand exactly what a specific field represents and the data types it contains. For example, if an analyst is unsure whether a timestamp is in milliseconds or seconds, or needs to know the difference between a ParentProcessId and a ContextProcessId, the Events Full Reference is the primary source of truth. Utilizing this document is a core part of the Hunting Methodology , as it allows the hunter to move beyond the high-level GUI and build precise, technical queries based on a deep understanding of the underlying data structure. Without referencing this data dictionary, an analyst might misinterpret field values, leading to "false negatives" in their search results. It is the essential roadmap for navigating the massive amounts of telemetry stored within the Falcon platform.