crowdstrike.exporter.api_requests.total

API requests to Falcon API

Dimensions:None

Technical Annotations (4)

Configuration Parameters (1)

refreshActiveSessionIntervalrecommended: >= 300

Server-provided value; < 300 seconds triggers negative duration bug in affected Filebeat versions

Technical References (3)

x-pack/filebeat/input/streaming/crowdstrike.gofile pathrefreshActiveSessionURLcomponentfalconHoseStreamcomponent

API and log ingestion misconfiguration causes alert duplication or visibility losswarning

▸

CrowdStrike refresh endpoint floods when server interval under 5 minutescritical

▸