This has to be the longest I've waited for an agent update between releases for a while and we're close a second point release for 26.04.

Last commit was over a year ago.

https://github.com/CrowdStrike/psfalcon

Is there a way to scan specific host groups in the exposure management network scanning feature?

Wondering if anyone else is seeing this.
We opened a ticket with our Falcon Complete team. But I'm curious if this is a sensor issue and if anyone is seeing a large number of these alerts.

An attack seems unlikely in our scenario as we have disjointed networks protected under the same CS Falcon tenant and we're seeing his from multiple environments.

What does everyone do to handle duplicate hosts? What are best practices when someone installs a sensor and then wipes and installs again creating a duplicate host in the host management.

Hi All

Im trying to write a query that will show the time difference between when a log is ingested and when a rule has triggered. Ive been looking through docs but could do with some help on which repos or events I should be looking at.

So far ive been experimenting with the detections and xdr_indicatorsrepo repos, but Im not sure this is correct?

Are detections logged in a way that they can be queried? Which time fields should I be using to compare the detections to the raw log?

Thanks

I want to look through and see devices that have had no USB mass storage devices connected over the last X amount of days. Is this possible or easy to query? The idea is to see who I have allowed to use USB devices and if they are not using them (not an actual business need).

Hello Team,

I am new to soc team. I recently joined an organization as soc analyst. I am facing issue while investigating crowdstrike alerts. Can anyone pls tell me how to investigate Custom IOC DOMAIN/Ip critical alerts in crowdstrike falcon.

We manage a large Windows fleet using Falcon Spotlight for vulnerability management and ManageEngine for patching. Our current manual process for high-priority vulnerabilities:

1. Receive a Jira ticket with a CrowdStrike CSV (affected devices, software, version, KB/remediation).
2. Run a script via ManageEngine to verify the vulnerable software and check if the patch/superseding patch is missing. (Because I find that Falcon loves false positives)
3. Filter down to confirmed affected endpoints.
4. Manually configure and deploy the patch.

My questions are: How are other teams automating the pipeline between CrowdStrike Spotlight findings and ManageEngine deployment? Is manual pre-verification necessary, or can/should ManageEngine handle patch detection and supersedence natively via automated patch policies?What industry best practices or integrations would streamline this workflow?

We did a POV with AIDR before fal.con and thought it was beta at very best. Now a few months have past a rename happened and my salesdude is trying to sell me it for 140k all in.

Unfortunately, I don't know of any competitors to it but man I hate to get it at that price with what we saw in August.

Can I get some thoughts on what you do, if you have it and how it is now. Competitors? RSA is so far away but I may just bury my head in the sand and build requirements until I can shop at RSA in the spring. 🤷‍♂️

As the title suggests, I'm looking for some guidance on configuring a Fusion Workflow to trigger upon an NGSIEM Detection that contains a particular detection name, which then feeds the username that triggered the detection into the SOAR function to revoke Entra session tokens (and maybe even the function to disable accounts or reset passwords). After a successful or failed completion, it would update the detection with that note and send an email to the team.

I am in desperate need to surface all the activity from a recent engagement we had. I thought the fastest way, without agentworks, is to stand up a CrowdStrike MCP server, create a Copilot agent and (the unknown) give it access to the MCP to hunt based on my NLPs. I am hoping others in this forum have done this or similar setups and can give me some insights, gotchas, or other advise on how to make this work.

thanks in advance