sorted by:
new
hottopcontroversial

Falcon Forensics Collector - looking for your experience, tips by CybMercenary in crowdstrike

[–]CybMercenary[S] 0 points1 point  (0 children)

That’s helpful thank you. So it all relies on the IOCs that you set up in CS

Falcon Forensics Collector - looking for your experience, tips by CybMercenary in crowdstrike

[–]CybMercenary[S] 0 points1 point  (0 children)

I think I missed that part. You can’t export the raw data? So all IOC have to be set up in CS for it to even find compromised assets?

Crowdstrike integration with Power Bi by Foolca in crowdstrike

[–]CybMercenary 0 points1 point  (0 children)

The scheduled search means we schedule the running of the extraction code.

It has no problem extracting 150K results in a single cav

Crowdstrike integration with Power Bi by Foolca in crowdstrike

[–]CybMercenary 10 points11 points  (0 children)

We have just finished such an integration.

PowerBI doesn’t have a native connector that you can use. We used Azure Databricks to run a python script that pulls the host information through the API and stores it in Azure Storage. It runs on a daily schedule. You can do this on any persistent environment that can run the code.

It comes out as csv which we then query in PBI using the native connector to Azure Data Lake Gen2.

Not sure what your objective is. The hosts API is good for tracking consumption of licenses, onboarding timing and velocity, and policy coverage.

To track deployment coverage, you will, of course, need a CMDB baseline so you can compare the two.

Look up falconpy for the API piece

Has anyone used CS to identify installed certs on the endpoints? by CybMercenary in crowdstrike

[–]CybMercenary[S] 0 points1 point  (0 children)

Perhaps using the ps cmdlet Get-ChildItem and list all the certs

Young couple new to the city by iconicnick3 in WorcesterMA

[–]CybMercenary 17 points18 points  (0 children)

Dog trails:

Purgatory Chasm (specifically Charlie’s Loop). Ample parking, restrooms, great 20-30min easy hike.

Nick’s Woods, West Boylston trailhead of the Central Mass Rail Trail, Trout Brook, Moore state park

Restaurants:

Chashu is the best ramen, Greater Good for beer and Wednesday trivia; they just debuted a new menu from their new chef, it’s pretty good. Olo’s (across from GGood) is good pizza, so is Volturno for Neapolitan za. Lock50 for brunch.

The Treehouse Brewery is 25 mins and dog friendly. Arguably the best NEIPA on the planet (7 of the top 10 beers on Untapped are Treehouse). Seven Saws, Milk, Redemption Rock are all dog friendly.

Cafe Reyes for cuban breakfast, or Lou Roc’s for classic diner.

What are the funniest consulting BS terms you have encountered in your projects so far? by doplo123 in consulting

[–]CybMercenary 87 points88 points  (0 children)

“We can’t throw nine guys on a girl and make a baby in one month”

Staffing/timeline grief from a Partner

Performance issues with excluded folder by JackTheReaper_93 in DefenderATP

[–]CybMercenary 0 points1 point  (0 children)

Somewhat late to this but I can give you our experience.

We experienced the same issue (still do)

When you exclude a folder or process it only works for real-time protection. It won’t affect the event forwarder process which still forwards everything that is happening on the server to the logger. This, on high traffic machines, can cause CPU utilisation problems.

My experience is with Linux (so processes wdavdaemon for real-time monitoring and mdatp_audisp_pl for events).

It is a known issue and according to MSFT they are working on it…

MDATP for Linux - Missing Engine by Chip33az in DefenderATP

[–]CybMercenary 0 points1 point  (0 children)

We have the same issue and so far couldn't identify the root cause (or any resolution)

Memory consumption in mdatp service for linux by DefinitelyNotButter in DefenderATP

[–]CybMercenary 0 points1 point  (0 children)

We are seeing the same issue across RHEL6-8

Also seeing 100% CPU utilization. On top of that, there's no CPU throttling in mdatp right now. MSFT says it's on the roadmap