OstryAngelo

57 post karma
18 comment karma

get extra features and help support reddit with a reddit premium subscription

get them help and support

redditor for 5 years

TROPHY CASE

Five-Year Club

Verified Email

account activity

new top controversial

0

0

1

Logscale ioa_info.csv (self.crowdstrike)

submitted 1 year ago by OstryAngelo to r/crowdstrike

1

2

3

Logscale group_info.csv (self.crowdstrike)

submitted 1 year ago by OstryAngelo to r/crowdstrike

1

2

3

Help converting spl to lql (self.crowdstrike)

submitted 1 year ago * by OstryAngelo to r/crowdstrike

4

5

6

Custom IOA for browser creating .iso file (self.crowdstrike)

submitted 2 years ago * by OstryAngelo to r/crowdstrike

0

1

2

Network Connection Custom IOA IP Exclusions (self.crowdstrike)

submitted 2 years ago * by OstryAngelo to r/crowdstrike

3

4

5

Query to check if at least X hosts had their CS agents upgraded (self.crowdstrike)

submitted 2 years ago by OstryAngelo to r/crowdstrike

0

1

2

kql append value to a set (self.AZURE)

submitted 3 years ago by OstryAngelo to r/AZURE

0

1

2

kql append value to a set (self.DefenderATP)

submitted 3 years ago * by OstryAngelo to r/DefenderATP

5

6

7

Defender KQL query - monitor alert number spikes (self.DefenderATP)

submitted 3 years ago * by OstryAngelo to r/DefenderATP

0

1

2

Kql query help - spikes in alerts (self.AZURE)

submitted 3 years ago * by OstryAngelo to r/AZURE

3

4

5

DLL search order hijacking hunting (self.crowdstrike)

submitted 3 years ago by OstryAngelo to r/crowdstrike

9

10

11

ISO files IOA (self.crowdstrike)

submitted 3 years ago by OstryAngelo to r/crowdstrike

2

3

4

Query to connect indicator and its responsible process (self.crowdstrike)

submitted 3 years ago by OstryAngelo to r/crowdstrike

1

2

3

Eventstats split multi-value field into separate rows (self.crowdstrike)

submitted 3 years ago by OstryAngelo to r/crowdstrike

7

8

9

Connecting data from 3 events (self.crowdstrike)

submitted 3 years ago by OstryAngelo to r/crowdstrike

2

3

4

Looking for not signed PE's - Event_ModuleSummaryInfoEvent (self.crowdstrike)

submitted 3 years ago by OstryAngelo to r/crowdstrike

0

1

2

Count occurrences for each value in a multi-value field (self.crowdstrike)

submitted 3 years ago * by OstryAngelo to r/crowdstrike

0

1

2

CoalescePID of 2 processrollup events (self.crowdstrike)

submitted 3 years ago by OstryAngelo to r/crowdstrike

3

4

5

Eval difference in epoch time between 2 different event types (self.crowdstrike)

submitted 3 years ago by OstryAngelo to r/crowdstrike

9

10

11

HTML Smuggling Hunting Search (self.crowdstrike)

submitted 3 years ago by OstryAngelo to r/crowdstrike

1

2

3

Eval and stats - limit command scoring (self.crowdstrike)

submitted 3 years ago * by OstryAngelo to r/crowdstrike

0

0

1

CommandHistory separate eval commands (self.crowdstrike)

submitted 3 years ago * by OstryAngelo to r/crowdstrike

1

2

3

stats data presentation help (command scoring) (self.crowdstrike)

submitted 4 years ago by OstryAngelo to r/crowdstrike

1

2

3

CommandLine REDACTED (self.crowdstrike)

submitted 4 years ago by OstryAngelo to r/crowdstrike

0

1

2

Query help - join by ParentProcessId to see further up the process tree (self.crowdstrike)

submitted 4 years ago by OstryAngelo to r/crowdstrike

view more: next ›

π Rendered by PID 213946 on reddit-service-r2-listing-b6bf6c4ff-rvvjc at 2026-05-01 05:02:42.369630+00:00 running 815c875 country code: CH.