The API Audit Log is the designated location within the CrowdStrike Falcon platform for recording all interactions with the Falcon API. This log specifically captures events related to API clients and their usage, including creation, modification, and deletion of API credentials. Crucially, it records both successful and failed authentication attempts made via the API. Therefore, to identify failed API authentication, an administrator must review the API Audit Log. This is essential for security monitoring, detecting potential misuse of API keys, and troubleshooting integration issues.

A. Login Audit Log: This log tracks user authentication events (successes and failures) for the Falcon web console (UI), not for programmatic API access.
B. Sensor Update Audit Log: This log records activities related to the Falcon sensor on endpoints, such as policy or software version updates, and is unrelated to API authentication.
C. User Activity Audit Log: This log captures the actions a user performs after successfully authenticating, such as creating policies or managing hosts, not the authentication attempts themselves.

1. CrowdStrike Falcon Documentation, "Investigate app: Audit logs": This official documentation explicitly describes the contents of each audit log. It states, "The API audit log shows a record of API clients that were created, deleted, or updated, and shows successful and failed API calls." This directly confirms that failed API authentication attempts are found in this specific log.

2. CrowdStrike Falcon Documentation, "Falcon API for Developers": In the section on API clients and authentication, the documentation details how API requests are authenticated using a client ID and secret. The corresponding audit trail for these authentication events is maintained in the API Audit Log, as referenced in the platform's administrative guides.

3. SANS Institute, "FOR578: Cyber Threat Intelligence" Courseware: This course often utilizes the CrowdStrike Falcon platform in labs. The course materials explain that programmatic interaction for threat intelligence automation is done via the API, and all such access, including authentication failures, is logged in the API Audit Log for security and operational review. (Reference to general principles taught in advanced cybersecurity courseware).