diff --git a/packages/crowdstrike/data_stream/falcon/_dev/deploy/docker/files/config.yml b/packages/crowdstrike/data_stream/falcon/_dev/deploy/docker/files/config.yml
index 84cf411c285..d0a915dc457 100644
--- a/packages/crowdstrike/data_stream/falcon/_dev/deploy/docker/files/config.yml
+++ b/packages/crowdstrike/data_stream/falcon/_dev/deploy/docker/files/config.yml
@@ -62,6 +62,16 @@ rules:
           {"metadata":{"customerIDString":"abcabcabc22222","offset":2,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1698932494000,"version":"1.0"},"event":{"SessionId":"1111-fffff-4bb4-99c1-74c13cfc3e5a","HostnameField":"UKCHUDL00206","UserName":"admin.rose@example.com","StartTimestamp":1698932494,"AgentIdString":"fffffffff33333"}}
           400
           {"metadata":{"customerIDString":"abcabcabc22223","offset":3,"eventType":"RemoteResponseSessionStartEvent","eventCreationTime":1698932494000,"version":"1.0"},"event":{"SessionId":"1111-fffff-4bb4-99c1-74c13cfc3e5a","HostnameField":"UKCHUDL00206","UserName":"admin.rose@example.com","StartTimestamp":1698932494,"AgentIdString":"fffffffff33333"}}
+  - path: /events
+    methods: ["GET"]
+    request_headers:
+      authorization: ["Token secretsessiontoken"]
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - "application/json"
+        body: ''
   - path: /refresh
     methods: ["POST"]
     responses: