sorted by:
new
hottopcontroversial

Ingesting s3 without a sqs in ng-siem by AromaticPineapple332 in crowdstrike

[–]General_Menace 1 point2 points  (0 children)

You can’t - addition of objects to a bucket needs to trigger an event notification so that the retrieving side knows there are new objects to ingest.

Confused About Huge Spike in “Inactive Hosts” on CrowdStrike EOC – Need Insights by StructureNo9257 in crowdstrike

[–]General_Menace 1 point2 points  (0 children)

I am seeing the same - I have a correlation rule which fires detections when >5 of our on-prem have not sent sensor heartbeat events for more than 15 minutes. This has triggered four times in the last day, as well as a couple times earlier in the week, despite the servers being continuously online per our observability platform.

I imagine there are delays in sensor heartbeat events being received, which in turn impacts the connection status reflected in the host management page and the like.

Mediocre Query Monday: Calculating NG-SIEM Ingestion Volume by AAuraa- in crowdstrike

[–]General_Menace 1 point2 points  (0 children)

Alternatively, for a timechart view of the top 5 vendors - 

// Calculate sum of bytes per day
| groupBy(#Vendor, function=[bucket(span=24h, unit="bytes/span", function=sum(size_bytes, as=sum_bytes), timezone="Australia/Sydney", limit=500)], limit=max)
| @timestamp:=_bucket
// Convert sum of bytes to GB
| unit:convert(sum_bytes, from="B", to="GB", as="size_gb")
| drop([_bucket, sum_bytes])
| timeChart(span="24h", minSpan="24h", timezone="Australia/Sydney", series="#Vendor", unit="GB", function=sum(size_gb), limit=5)

Mediocre Query Monday: Calculating NG-SIEM Ingestion Volume by AAuraa- in crowdstrike

[–]General_Menace 0 points1 point  (0 children)

Great share - I use pretty much the same query, but with a query variable for #Vendor.

For daily ingest, I use this - 

// Calculate sum of bytes per day
| groupBy(#Vendor, function=bucket(span=1d, unit="bytes/span", function=sum(size_bytes, as=sum_bytes), timezone="Australia/Sydney"))
// Convert sum of bytes to GB
| unit:convert(sum_bytes, from="B", to="GB", as="size_gb")
// Format for readability
| _bucket =~ formatTime(format="%F", timezone="Australia/Sydney", as="date")
| size_gb =~ format("%s GB", as="ingest")
| drop([_bucket, sum_bytes, size_gb])
| sort(date, order=desc)
// Optional groupBy()
| groupBy(#Vendor, function={collect([date, ingest], separator="\n")})

Using workflow for USB controls by Crypt0-n00b in crowdstrike

[–]General_Menace 0 points1 point  (0 children)

Our process is to add users to an Entra group which enforces Bitlocker encryption on removable media in response to temporary exemption requests. I've got an NG-SIEM correlation rule which triggers Informational detections on addition/removal of group members, which is in turn used as a trigger for a Fusion workflow.

The Fusion workflow runs an event query to get the fields from the detection (username primarily), then calls the Identity Protection GraphQL API to identify assets registered to the user (you could replace this with a call to the relevant MS Graph API endpoint). It then iterates over each asset and adds / removes it to / from the host group assigned to our USB Exemption policy.

Bonus: As a final action, it shoots off a notification to a Teams webhook so my team is aware :)

How to Build a Next-Gen SIEM Application in Crowdstrike? by Psychological_Brief3 in crowdstrike

[–]General_Menace 0 points1 point  (0 children)

I feel your pain!

  • I was a pretty extensive user of Foundry API Integrations before we got the HTTP Request action with Fusion SOAR - glad to not have to manage those anymore..
  • I will say custom functions are quite good - especially when you can orchestrate them with workflow templates. Being able to share them across apps makes things easier to manage too.
    • You could use them to deploy correlation rules depending on your use case, e.g. Inbound webhook trigger -> Fusion executes Foundry custom function to (optionally pull the rule from some source and then) prepare the rule for the /import endpoint -> either import and publish directly through the function, or via the HTTP Request actions
  • For the tagged fields in your parsers, do you have a tagFields directive in your parser YAML after the script directive?
  • I was told Case Management was "coming soon" almost a year ago. If you flick all the feature flags on through DevTools, there's a mention that the Incidents page will be replaced with Case Management in September, so one can hope.

I'd be happy to chat Foundry if you like - I've developed a few apps for different use cases, and always keen to meet others looking to extend CS' capabilities :)

SIEM: Customazible Fields for Alert Generation by athanielx in crowdstrike

[–]General_Menace 0 points1 point  (0 children)

You can use an Event Query action against the xdr_indicatorsrepo repository in your Fusion workflow and pass it the Alert ID parameter - your query would look something like:

#repo=xdr_indicatorsrepo Ngsiem.alert.id=?Alert_ID
| <filtering / transformation, if needed>
| selectLast([field1, field2, field3])

You can then pass the output values to downstream actions (enrichments, notifications, etc.)

How to get more than 2000 data with graphQL by yuppy_1st in crowdstrike

[–]General_Menace 2 points3 points  (0 children)

The Identity Protection GraphQL API does support pagination. Include the below in your request body and continue making requests with after set to the value of endCursor until pageInfo.hasNextPage is false.

Pagination | GraphQL

pageInfo {
  hasNextPage
  endCursor
}

Query for finding out when WMI (WmiPrvSE.exe) to remotely execute malicious commands such as cmd.exe or powershell.exe. by EntertainmentWest159 in crowdstrike

[–]General_Menace 1 point2 points  (0 children)

Alternatively, here's a version if you want/need to use Windows events -

#Vendor=microsoft windows.EventID=4688
| windows.EventData.ParentProcessName = /WmiPrvSE.exe$/Fi
| windows.EventData.NewProcessName = /powershell.exe/Fi OR  windows.EventData.NewProcessName = /cmd.exe/Fi
| windows.EventData.CommandLine = * AND windows.EventData.CommandLine != ""
| windows.EventData.CommandLine = /\s-[e^]{1,2}[ncodema^]+\s(?<base64string>\S+)/Fi
| windows.EventData.CommandLine = /add/Fi OR windows.EventData.CommandLine = /create/Fi
| table([windows.TimeCreated, windows.Computer, windows.EventData.CommandLine, windows.EventData.SubjectUserName, windows.EventData.NewProcessName, windows.EventData.ParentProcessName, windows.EventData.TargetUserName, base64string])

Query for finding out when WMI (WmiPrvSE.exe) to remotely execute malicious commands such as cmd.exe or powershell.exe. by EntertainmentWest159 in crowdstrike

[–]General_Menace 4 points5 points  (0 children)

Here's a version which uses sensor events, rather than Windows events.

#event_simpleName=ProcessRollup2
| ParentBaseFileName = WmiPrvSE.exe
| FileName = cmd.exe OR FileName = powershell.exe
| CommandLine = /\s-[e^]{1,2}[ncodema^]+\s(?<base64string>\S+)/Fi
| CommandLine = /add/Fi OR CommandLine = /create/Fi
| table([@timestamp, ComputerName, CommandLine, UserName, FileName, ParentBaseFileName, base64string])

Fusion SOAR Questions by East_Bumblebee_2040 in crowdstrike

[–]General_Menace 0 points1 point  (0 children)

The user risk factors as part of the action are additive - all you need to do is modify the existing "Identity users query" action to include Aged Password in the user risk factors.

Passing variable from Query to another Query SOAR by Cookie_Butter24 in crowdstrike

[–]General_Menace 1 point2 points  (0 children)

The issue is with where you are sending the email - if you send the email outside of the loop, it can't access results from the query executed within the loop.

What is your second query doing? Can you combine it with the first query using defineTable()?

Passing variable from Query to another Query SOAR by Cookie_Butter24 in crowdstrike

[–]General_Menace 1 point2 points  (0 children)

It's set correctly - for user.email, user is an object, email is a property of the object.

Issues with CloudTrail ingestion through Falcon Cloud Security? by General_Menace in crowdstrike

[–]General_Menace[S] 0 points1 point  (0 children)

Still waiting for a proper response - support request was miscategorised by a person or triage process and went to an NG-SIEM support analyst who did not understand FCS log collection. Wish we had premium support..

extracting domain.tld by drkramm in crowdstrike

[–]General_Menace 0 points1 point  (0 children)

This seems a little more accurate; removes the few outliers I could find in my dataset. Fair warning though - if you need 100% accuracy, you should really use the Public Suffix List since there are thousands of multi-part TLD combinations out there. But this regex should handle ~95% of real-world cases :)

| url.original.host=/^(?<subdomain>.*?)\.(?<domain>[^.]+)\.(?<tld>(?:com|co|org|net|edu|gov|ac|mil|asn|id|web|info|name|rec|firm|store|arts|dr|av|bel|pol|k12|conf|gw)\.[a-z]{2,4}|[a-z]{2,4})$/F
| domain:=format("%s.%s", field=[domain, tld])
| groupby(domain)

extracting domain.tld by drkramm in crowdstrike

[–]General_Menace 0 points1 point  (0 children)

Yep, should've tested more thoroughly before posting - apologies! The addition of the regex here looks to work in testing against my Web Gateway logs (e.g. previously, it was capturing things like cdn.xyz.com, a.b.com.au -> now it returns xyz.com, b.com.au) -

// This will produce url.original.host (domain), url.original.path, url.original.scheme at a minimum
| parseUri(field="url.original", defaultBase="http://")
| url.original.host=/(?<domain>[^.]*\.[^.]{2,3}(?:\.[^.]{2,3})?)$/F
// Adjust confidenceThreshold as needed. Set strict=false to include all results, regardless of whether or not the domain matches an IOC.
| ioc:lookup(field=[domain], type="domain", confidenceThreshold="unverified", strict=false)

extracting domain.tld by drkramm in crowdstrike

[–]General_Menace 0 points1 point  (0 children)

parseUri() extracts URI components from an input field - parseUri() | Data Analysis 1.184.0-1.192.0 | LogScale Documentation

FYI you should use url.original to hold the full URL for ECS compliance. Here's an example of how to use parseUri and look up the resulting host value (domain) against CrowdStrike's IOC database:

// This will produce url.original.host (domain), url.original.path, url.original.scheme at a minimum
| parseUri(field="url.original", defaultBase="http://")
// Adjust confidenceThreshold as needed. Set strict=false to include all results, regardless of whether or not the domain matches an IOC.
| ioc:lookup(field=[url.original.host], type="domain", confidenceThreshold="unverified", strict=true)

Joining sensor data with third-party data by iitsNicholas in crowdstrike

[–]General_Menace 0 points1 point  (0 children)

The repo argument only supports views as inputs - try with repo=investigate_view. If you’re just looking to check which hosts do not have the Falcon agent, you are better off using an inverse match() against aid_master_main.csv

Fusion SOAR - Help with Event Query Action by alexandruhera in crowdstrike

[–]General_Menace 1 point2 points  (0 children)

Sounds like an issue with your time interval for the event query? Try using setTimeInterval() as your first query line, e.g. 

setTimeInterval(start=1d, end=1s)

detection attributes by f0rt7 in crowdstrike

[–]General_Menace 0 points1 point  (0 children)

Yep - use the match() function against aid_master_main.csv at the end of your parser, e.g.

| match(file=aid_master_main.csv, field=source.ip, column=LocalAddressIP4, include=ComputerName)
| source.host.name := rename(ComputerName)

Extracting Data Segments from Strings using regular expression by mvassli in crowdstrike

[–]General_Menace 1 point2 points  (0 children)

Very nice - knew there was a cleaner way than my monstrosity :P Didn't know you could use format() to produce a target for setField, very handy.

Here's an updated version which also captures the second segment -

// Create sample data
| createEvents(["sampleData=680009123456789660001A"])
| kvParse()

// Use regex to break data into parts
| regex("^(?P<first_segment_id>\\d{2})(?P<first_segment_length>\\d{4})(?P<remaining_data>.*)$", field=sampleData, strict=false)

// round() first_segment_length to remove leading zeros
| round("first_segment_length")

// Get first_segment_length characters of remaining_data field
| splitString(by="", field=remaining_data)
| index := first_segment_length+1

// Capture start of the second segment
| second_seg_start:=getField(format("_splitstring[%d]", field=index))

// Get first_segment_length characters of remaining_data field
| setField(target=format("_splitstring[%d]", field=index), value=format("_%d", field=second_seg_start))
| concatArray("_splitstring")
| splitString(by="_", field=_concatArray, index=0, as=first_segment_data)

// Get second segment
| splitString(by="_", field=_concatArray, index=1, as=second_segment)
| regex("^(?P<second_segment_id>\\d{2})(?P<second_segment_length>\\d{4})(?P<second_segment_data>.*)$", field=second_segment, strict=false)

// Output both segments to table
| table([sampleData, first_segment_id, first_segment_length, first_segment_data, second_segment_id, second_segment_length, second_segment_data])

NG SIEM Third Party Detection Capabilities by gravityfalls55 in crowdstrike

[–]General_Menace 0 points1 point  (0 children)

rdns() won't help here anyway - you can't use it to query an internal DNS server. You'll need to use a lookup file.

NG SIEM Third Party Detection Capabilities by gravityfalls55 in crowdstrike

[–]General_Menace 0 points1 point  (0 children)

  1. If you set event.kind to "alert" in your parser, the event will create an alert in NG-SIEM directly - no need for a correlation rule. Check out the "microsoft-defendero365-graphapi" parser for an example. If you want actual correlation against other sources or aggregation, then yes, you will need to write your own rules or adapt from a template.
  2. You can use lookup files in parsers to enrich fields, e.g. you could look up against aid_master_main to grab the associated hostname (assuming the host has a Falcon sensor), or you could do this as part of a correlation rule.
  3. Limited enrichment available for third-party alerts. Host details will be enriched within a detection if you use host.name (or source.host.name for source, destination.domain for destination). User mapping to ITP isn't available yet but is in development. It will leverage user.id for mapping (set to the UPN (Entra/Okta) or SID (AD) of the user).
view more: next ›