---
title: "CrowdStrike Raw Events"
slug: "crowdstrike-raw-events"
updated: 2026-04-24T20:45:48Z
published: 2026-04-24T20:45:48Z
canonical: "docs.hunters.ai/crowdstrike-raw-events"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# CrowdStrike Raw Events

#### Overview

**Table name:** `crowdstrike_raw_events`

CrowdStrike raw events represent the detailed data captured by the Falcon sensor installed on each endpoint. These events encompass a wide range of activities. Use Event Streams when you need raw, real-time event data for custom analysis and correlation in your own tools

#### Send data to Hunters

**Prerequisites**

- Create an AWS SQS and S3-Bucket.
- Use:
  - Falcon Insight XDR
  - Falcon Data Replicator

**Step 1: Connect Hunters to your CrowdStrike portal**

- Log into the CrowdStrike Falcon Portal. (you can follow [this official Crowdstrike guide](https://falcon.crowdstrike.com/documentation/page/fa572b1c/falcon-data-replicator) as well)
- In the Falcon console, from the left-side menu, click Support and resources → Resources and tools → Falcon Data Replicator
  - On that page you should see:
    - FDR feeds tab (this is the one you want)
    - Possibly Audit log
    - Possibly FFC feeds (only if entitled)
  - If you don’t see “Falcon Data Replicator” at all:
    - You do not have the FDR subscription
    - Or you are not a Falcon Administrator
- Important clarification: you do NOT need FFC → You need only `FDR feed` (First-party / CrowdStrike sensor data)
- There is NO separate “data replication setup” wizard anymore
  - FDR works like this now:
    - You create an FDR feed
    - CrowdStrike automatically provisions:
      - S3 bucket (unless you bring your own)
      - SQS queue
    - You consume the data
- Find (or create) your FDR feed:
- Go to Support and resources → Resources and tools → Falcon Data Replicator → FDR feeds → Now check:
  - If you see an existing feed → Open the info panel → Note the `S3 storage location` , `SQS URL` , `Client ID` → CrowdStrike is already sending data.
  - If you see no feeds → Create feed → Source: First-party data
    - Default settings (recommended initially)
    - Copy the Client ID + Secret immediately
    - Step 3 - Decide storage model
      - CrowdStrike hosts S3, 7-day retention
      - Your own S3 bucket, requires support ticket (for first-party data), requires bucket policy
  - Build your consumer (modern approach) recommended:
    - SQS → Lambda
    - Or SQS → ECS/Fargate (high volume)
      - Read SQS message
      - Fetch files from CrowdStrike S3
      - Copy to your S3 bucket
      - Delete SQS message

**Step 2: Create a data source on Hunters**

- Route your CrowdStrike raw events into an AWS S3 bucket.
- Once the export is completed and the logs are collected to S3, follow the steps in [this section](https://hunters.document360.io/docs/connect-data-through-aws-s3).

![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image(300).png?sv=2026-02-06&spr=https&st=2026-11-15T20%3A40%3A07Z&se=2026-11-15T21%3A40%3A07Z&sr=c&sp=r&sig=oC%2Fa4VrYNFsZ0E34cGxbywwpIo1IwdPZb%2FfaKUvkom8%3D)

![image](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image(301).png?sv=2026-02-06&spr=https&st=2026-11-15T20%3A40%3A07Z&se=2026-11-15T21%3A40%3A07Z&sr=c&sp=r&sig=oC%2Fa4VrYNFsZ0E34cGxbywwpIo1IwdPZb%2FfaKUvkom8%3D)

— CrowdStrike Raw Events —