File Write Events with Human-Readable File Sizes

# --- Query Metadata ---
# Human-readable name for the query. Will be displayed as the title.
name: File Write Events with Human-Readable File Sizes

# Description of what the query does and its purpose.
description: The query lists file write events and converts the file size into readable units (KB, MB, GB, or TB), displaying timestamps, host details, filenames, and both raw and formatted file sizes.

# The author or team that created the query.
author: CrowdStrike

# The required log sources to run this query successfully in Next-Gen SIEM.
# This will be displayed in the UI to inform the user.
log_sources:
  - Endpoint

# The CrowdStrike modules required to run this query.
cs_required_modules:
  - Insight

# Tags for filtering and categorization.
# Include relevant techniques, tactics, or platforms.
tags:
  - Hunting

# --- Query Content ---
# The actual CrowdStrike Query Language (CQL) code.
# Using the YAML block scalar `|` allows for multi-line strings.
cql: |
  #event_simpleName=/FileWritten$/ 
  | case {
      Size>=1099511627776 | CommonSize:=unit:convert(Size, to=T) | format("%,.2f TB",field=["CommonSize"], as="CommonSize");
      Size>=1073741824 | CommonSize:=unit:convert(Size, to=G) | format("%,.2f GB",field=["CommonSize"], as="CommonSize");
      Size>=1048576| CommonSize:=unit:convert(Size, to=M) | format("%,.2f MB",field=["CommonSize"], as="CommonSize");
      Size>1024 | CommonSize:=unit:convert(Size, to=k) | format("%,.3f KB",field=["CommonSize"], as="CommonSize");
      * | CommonSize:=format("%,.0f Bytes",field=["Size"]);
  }
  | table([@timestamp, aid, ComputerName, FileName, Size, CommonSize])

# Explanation of the query.
# Using the YAML block scalar `|` allows for multi-line strings.
# Uses markdown for formatting on the webpage.
explanation: |
  Reference: [GitHub CrowdStrike/logscale-community](https://github.com/CrowdStrike/logscale-community-content/blob/main/Queries-Only/Helpful-CQL-Queries/Case%20to%20convert%20Size%20to%20appropriate%20unit%20of%20measure.md)