New API Keys within the Falcon Platform

# --- Query Metadata ---
# Human-readable name for the query. Will be displayed as the title.
name: New API Keys within the Falcon Platform

# MITRE ATT&CK technique IDs
#mitre_ids:

# Description of what the query does and its purpose.
description: |
  This query provides a list of newly created API Keys, including relevant details such as Client Name and Client ID.

# The author or team that created the query.
author: ByteRay

# The required log sources to run this query successfully in Next-Gen SIEM.
log_sources:
  - Other

# Tags for filtering and categorization.
tags:
  - Monitoring

#cs_required_modules: 
#  - Insight
  
# --- Query Content ---
# The actual CrowdStrike Query Language (CQL) code.
# Using the YAML block scalar `|` allows for multi-line strings.
cql: |
  #event.dataset = falcon.cloud
  | OperationName = CreateAPIClient
  | user.id = *
  | "Client Name" := rename(Attributes.name)
  | "Client ID" := rename(Attributes.APIClientID)
  | "Scope(s)" := rename("Attributes.scope(s)")
  | table([timestamp,"Client Name","Client ID", "Scope(s)",OperationName,Success,Source,SourceIp,UserId])