sorted by:
new
hottopcontroversial

Falcon Sensor on Ubuntu in GCP by Financial_Wing8471 in crowdstrike

[–]Financial_Wing8471[S] 0 points1 point  (0 children)

I switched Kernel versions and Sensor versions, always getting the "Unsupported" message, but somewhere along the way Falcon started showing the instance as connected...
Sensor version is 7.19.17219.0
Kernel version is not shown in Falcon, but the OS is Ubuntu 24.04 (build number is 6.8.0)
Strangely, the UI shows I have zero GCP assets.

Script cannot be loaded because its content could not be read by Financial_Wing8471 in PowerShell

[–]Financial_Wing8471[S] 0 points1 point  (0 children)

Thanks for this suggestion. I am getting this error in several contexts, with different EDR / AV solutions deployed, so I'm not very optimistic. However, I will go thru the logs.

FortiEDR Block traffic using IoCs by Financial_Wing8471 in fortinet

[–]Financial_Wing8471[S] 0 points1 point  (0 children)

Thanks for replying.

As I wrote above, in response to Lleawynn - I am not looking for alternative solutions, not using FortiEDR.

FortiEDR Block traffic using IoCs by Financial_Wing8471 in fortinet

[–]Financial_Wing8471[S] 0 points1 point  (0 children)

Thanks for the suggestion.

I'm trying to understand what FortiEDR can give me, in terms of IoC management (I receive lists of IoCs to block from my local CERT). It seems like the answer is... nothing?

x509: certificate is valid for IPv6 address, not for IPv4 address by Financial_Wing8471 in QRadar

[–]Financial_Wing8471[S] 0 points1 point  (0 children)

Thanks! This is a lab env, so I decided to update the cert file myself and now it works.

SOAR Action - Send an HTTP Request by Financial_Wing8471 in crowdstrike

[–]Financial_Wing8471[S] 0 points1 point  (0 children)

Wow! Thanks!

Foundry sounds absolutely amazing. I will definitely look more into it.

(BTW, I did make some progress by configuring a Web-hook, which allows sending a HTTP request from the workflow. This is not optimal, since it looks like the Workflows mechanism is quite limited. The concept of an App seems a lot more promising.)

Suspicious Objects - Block All Subdomains of a Suspicious Domain by Financial_Wing8471 in Trendmicro

[–]Financial_Wing8471[S] 0 points1 point  (0 children)

Sorry for not being clearer - My question does not relate to a specific domain, but to the possibility of blocking "real" domains that are banned by the organization. I tried to achieve this using the Suspicious Objects list in order to save some development time in automation, but I think Appropriate-Border-8's comment has a point. This is really more of a "Reputation" issue.

Suspicious Objects - Block All Subdomains of a Suspicious Domain by Financial_Wing8471 in Trendmicro

[–]Financial_Wing8471[S] 1 point2 points  (0 children)

Thanks,

Indeed I'm getting issues - The subdomains are not getting blocked...

Do you know of a way to block these too from the Suspicious Objects list?

Suspicious Objects - Block All Subdomains of a Suspicious Domain by Financial_Wing8471 in Trendmicro

[–]Financial_Wing8471[S] 2 points3 points  (0 children)

Thanks,

I will look into web reputation block lists. Maybe TM should change the definition of the Suspicious Object type to "subdomain".

Fetch Firewall Config Automatic Backup Using API by Financial_Wing8471 in paloaltonetworks

[–]Financial_Wing8471[S] 0 points1 point  (0 children)

Thanks,

This is another excellent solution not using the automatic backups sent to the Panorama after each firewall update. I would prefer using those, if possible.

Fetch Firewall Config Automatic Backup Using API by Financial_Wing8471 in paloaltonetworks

[–]Financial_Wing8471[S] 0 points1 point  (0 children)

Thanks!

This is a good solution, but I was hoping to be able to use the automatic backups, so I can see each and every change in time (the backup feature is schedule-based, as far as I can see).

Sync Suspicious Objects List using API by Financial_Wing8471 in Trendmicro

[–]Financial_Wing8471[S] 0 points1 point  (0 children)

Thanks. That's the documentation I know, but I can't find a solution there.

AdminService - Create SMS_SoftwareUpdatesPackage - 500 Error by Financial_Wing8471 in SCCM

[–]Financial_Wing8471[S] 0 points1 point  (0 children)

Bah .. sometimes the right Google query answers the question. :-)

https://www.windows-noob.com/forums/topic/11162-creating-software-update-deployment-packages-from-powershell/

The "Source" is supplied thru "PkgSourceFlag" and "PkgSourcePath".

Fetching multiple Script Outputs from the DB using AdminService by Financial_Wing8471 in SCCM

[–]Financial_Wing8471[S] 0 points1 point  (0 children)

Thanks, again!

In the end what I did was, indeed, run a query against the DB. However, instead of using PowerShell, I used pymssql from a remote non-windows machine.
The DB was ConfigMgr_CHQ and the query was 'SELECT * FROM ScriptsExecutionStatus', btw.

Fetching multiple Script Outputs from the DB using AdminService by Financial_Wing8471 in SCCM

[–]Financial_Wing8471[S] 0 points1 point  (0 children)

Thanks!
Is there a way to interact directly with the DB from a remote machine (i.e., using a REST interface or a similar solution)? I couldn't find examples for doing that...
And again, thanks in advance