Audit Log Shows “Hide_host_requested” Entry

Issue

Red Canary Audit Logs show an audit log entry for Hide Host Requested, similar to the screenshot below.  What does that mean?

Environment

Red Canary Portal
CrowdStrike Integration

Resolution

This audit log entry indicates a host was hidden in the CrowdStrike Falcon console.

In CrowdStrike, hiding a host is used to reduce console clutter while keeping the option to restore the host later.  The hidden host is moved to the Hidden hosts page and removed from other Falcon console views.  If the host comes back online, it remains hidden until it is restored manually (or auto-restore is enabled).  While hidden, the host can continue sending events to CrowdStrike and receiving policy updates, but its activity is not surfaced in the Falcon console and generally won’t trigger console-driven outputs such as workflows, Event Streams visibility, or detection emails.

Cause

Some CrowdStrike audit log events, like hide host actions, are replicated into the Red Canary audit log.  See Audit Logs information about Audit Log sync with CrowdStrike.