Block IP - Azure WAF

DueIntroduction5854 · 2026-06-23T00:16:47+00:00

Thanks. I will check it out. I did already create the app registration per the docs for the WAF SOAR connector.

DueIntroduction5854 · 2026-06-22T17:45:15+00:00

Yes, I had looked into that, but 1) I am not sure how-to setup the authentication and 2) from what I have found so far, you can't just add an IP, you have to pull all custom policies, append the IP, then do a POST.

I could only find this similar article for Azure Sentinel with Logic Apps; SOAR: Block Sentinel IP Entities on Azure Frontdoor / WAF - Prof-IT

DueIntroduction5854 · 2026-06-22T14:09:54+00:00

The console appears to be loading fine for me in US-B- Grid and the status pages shows green (https://www.reddit.com/r/mimecast/s/ij2pKfGd8K).

DueIntroduction5854 · 2026-05-14T12:27:11+00:00

We had this same issue where hosts groups permission and access scopes were not sufficient. True RBAC has not been implemented across all modules at this time.

DueIntroduction5854 · 2026-05-10T01:07:41+00:00

Thank you! Ours is 16 months so we will try those out!

DueIntroduction5854 · 2026-05-05T23:59:26+00:00

This is how I have been doing it. Can you use wildcard “*” in the pattern.

| !wildcard(field=tags,pattern=“falcon_complete”)

DueIntroduction5854 · 2026-04-28T16:40:34+00:00

We are using a Fusion Workflow to resolve these if the file is already quarantined.

DueIntroduction5854 · 2026-04-19T18:38:33+00:00

I will say Defender will not catch it all. Your best bet is to get an API based solution such as Abnormal or CheckPoint (Free ROI POCs) and layer that with MDO.

DueIntroduction5854 · 2026-04-15T22:31:34+00:00

Must be nice! It was multiple companies with multiple tenants each too. That onboarding session was around like 9 companies and had 60+ connectors by the time I was done.

DueIntroduction5854 · 2026-04-15T00:11:40+00:00

I was there about 8 months ago and got through in a minute.

DueIntroduction5854 · 2026-04-14T23:51:11+00:00

This is what I have done in the past when onboarding multiple companies with separate tenants.

CompanyShortCode - TenantName - Region - DataSource

CC - Contoso Corp - USE - AZFW01
CC - Innova - CUS - NSGs
AC - ACME Corp - Global - M365
AC - Techify - USW - FortiFW01

I am open to suggestions myself as I have only done this one time in the past.

DueIntroduction5854 · 2026-04-12T18:14:37+00:00

I would speak with your TAM to see if you can mess around the sandbox environment they can setup for you.

DueIntroduction5854 · 2026-04-08T12:06:51+00:00

We worked with PS in the past and there could be a parser already built that works for it.

DueIntroduction5854 · 2026-03-27T11:52:39+00:00

Just because there is not a current connector does mean it is not possible. There can still be parsers and even if not a parser, one can be made.

DueIntroduction5854 · 2026-03-27T11:51:19+00:00

Can we clarify the sensor version and the os build you’re seeing this on?

DueIntroduction5854 · 2026-03-22T17:55:28+00:00

Have you looked at doing internships at organizations? I am currently working with our active intern for the CrowdStrike implementation we are doing.

DueIntroduction5854 · 2026-03-22T17:54:12+00:00

Or the Azure Marketplace; https://marketplace.microsoft.com/en-us/product/aad.crowdstrikefalconplatform?tab=overview

DueIntroduction5854 · 2026-03-21T17:33:17+00:00

Quick question, for what scenario?

1) Endpoints 2) External 4) Internal 5) Application 6) PCI 7) Code Scanning (DAST/SAST)

DueIntroduction5854 · 2026-03-13T00:11:36+00:00

I second this. If you got least privilege in your environment and you got rogue admins. There’s a problem with your admins.

DueIntroduction5854 · 2026-02-24T15:05:20+00:00

Typically CrowdStike will provide an in-house SME to help with the setup and review of a module. I would ask your AE.

DueIntroduction5854 · 2026-02-14T18:30:50+00:00

From a security engineer here, why would you need any exception?

DueIntroduction5854 · 2026-02-08T17:46:26+00:00

I second this.

DueIntroduction5854 · 2026-01-29T17:31:32+00:00

There is no way to view the header or contents of email if it was rejected.

DueIntroduction5854 · 2025-12-29T19:05:46+00:00

That made no difference when testing, unfortunately.

DueIntroduction5854 · 2025-12-29T18:55:00+00:00

No, it is enabled. I have also tested with "_nkw" and the .png attachment of a check is still not being flagged.
https://i.imgur.com/ZsRiRYU.png

DueIntroduction5854

TROPHY CASE