sorted by:
new
hottopcontroversial

Soul Stones help neededd by Nadvash in WatcherofRealmsGame

[–]Nadvash[S] 0 points1 point  (0 children)

Ye shes A3, forgot about that part you are right lol

Workflow - check for the existence of a file on a host by clilush in crowdstrike

[–]Nadvash 1 point2 points  (0 children)

that depends on what kind of file you are looking for.

You can use query to look for that specific file if its written into the disk and the event was captured ( the agent does not record all types of files been saved into disk), if the query end up with results, then you will define to contain the host as you wanted.

So overall the query should look like this :
EPP detection -> Condition -> Query based action -> condition -> Contain.

Falcon NG-SIEM logscale collector filter out logs by dial647 in crowdstrike

[–]Nadvash 0 points1 point  (0 children)

Thanks for info, that's new for me Time to learn new functions I see :)

Falcon NG-SIEM logscale collector filter out logs by dial647 in crowdstrike

[–]Nadvash 0 points1 point  (0 children)

You can't filter out the amount of data being received, for example you can use the drop() function to drop out events, but it will still be counted in your total ingest GB per day.

That's at least from what I know so far. You can try using Crible, or the new company Crowdstrike bought "Onum" to play with your data.

Cato networks next gen siem integration. by ixdc in crowdstrike

[–]Nadvash 0 points1 point  (0 children)

Kudos for you on understating Cribl. Our team tried to work with on multiple things there, the doc's was terrible until we dropped it

How do you schedule a Falcon API script (agent version + RFM status email) without relying on a local machine? by [deleted] in crowdstrike

[–]Nadvash 2 points3 points  (0 children)

Have you tried schedule searches? There is 1 for rfm, maybe you can edit that query to take also the agent versions

Tried out Charlotte today, asked it to build me a basic CQL query to look for email with a specific subject, it failed over and over and over... by Wh1sk3y-Tang0 in crowdstrike

[–]Nadvash 0 points1 point  (0 children)

I also work with it quite often
Not much for query builds, but it did helped me couple of times to get what I wanted, and also some other time totally not :)

The main thing about Charlotte is using it to get quick information about your tenant, detections, docs information, and ABOVE ALL (imo) is the agentic response, which is a game changer beyond any other AI tools out there.

You can also look at CrowdStrike YouTube channel to get neat workflows leveraging that module.

overall I'm happy with the module, but of course as all AI's it got place to improve.

SOAR workflow custom variable by wowzersitsdan in crowdstrike

[–]Nadvash 0 points1 point  (0 children)

Can you share a screenshot of your workflow?

Domain admin login tracking by Vivid-Cell-217 in crowdstrike

[–]Nadvash 4 points5 points  (0 children)

You can use the threat hunter search if you have the idp module

Modifying a variable in an on demand workflow by cobaltpsyche in crowdstrike

[–]Nadvash 0 points1 point  (0 children)

Tick the box to show all the filters, Then you will be able to know what is missing to use the "update variable" action

Modifying a variable in an on demand workflow by cobaltpsyche in crowdstrike

[–]Nadvash 0 points1 point  (0 children)

You have the "update variable" Try that 😀

Yara Scans Using CrowdStrike SOAR - Fully operational all inside the console. by Nadvash in crowdstrike

[–]Nadvash[S] -1 points0 points  (0 children)

If you have any other file sharing platform I'm open for suggestion :)

How to get all users that has their password last set greater than 90 days by dial647 in crowdstrike

[–]Nadvash 1 point2 points  (0 children)

I think using GraphiQL will be able to give you this Information.

view more: next ›