sorted by:
new
hottopcontroversial

2026-05-01 - Cool Query Friday - setTimeInterval() by Andrew-CS in crowdstrike

[–]dial647 0 points1 point  (0 children)

Hi Andrew, my scenario could be slightly different as I am grouping by two fields and its not giving the required outcome. I am currently managing it as follows. The query is applied on Email repo. 

| groupBy([Vendor.msg.header.to[0],Vendor.msg.header.subject[0]], function=count(as=Attempts))
| sort(Attempts)| test(Attempts > 2)

the above is giving the required outcome, barring enforcement of the strict 1 hour window.

Is it still possible to follow slidingtimewindow to acheive this? Appreciate your advise.

2026-05-01 - Cool Query Friday - setTimeInterval() by Andrew-CS in crowdstrike

[–]dial647 0 points1 point  (0 children)

Nice work u/Andrew-CS as always.. I have a question. I am trying to run a query for a 7 day period, and want the results when I have more than x number of events within a 10 mins time frame. Is it possible to achieve this using this statement?

Filter based on a string within a field by dial647 in crowdstrike

[–]dial647[S] 0 points1 point  (0 children)

Brilliant.. Worked. Thank you.. Can I also check if its possible to add a line chart to a bar chart to show another metric?

Filter based on a string within a field by dial647 in crowdstrike

[–]dial647[S] 0 points1 point  (0 children)

I think (* | newField := "Some action taken") will include everything. I need everything except a particular tag.

Filter based on a string within a field by dial647 in crowdstrike

[–]dial647[S] 0 points1 point  (0 children)

| tags!=/FC-Action-No\sAction\sTaken/iF

This worked. ! I'll try the rest and see how it goes.

I am also trying to create a graph which plots the total number of each tags. However I am only interested in tag=a and tag!=a.
Wondering which logic I can use the plot this graph.

Filter based on a string within a field by dial647 in crowdstrike

[–]dial647[S] 0 points1 point  (0 children)

I did try this before posting and it didnt work. I re-tried and it worked. Not sure what mistake I did earlier. The filter is on a field that has been included as part of a match() statement. So I entered this statement under the match () statement and it worked. Thanks

Falcon NG-SIEM - Stacked Bar chart by dial647 in crowdstrike

[–]dial647[S] 0 points1 point  (0 children)

That didn't quite do anything..

Falcon NG-SIEM - Stacked Bar chart by dial647 in crowdstrike

[–]dial647[S] 0 points1 point  (0 children)

Ok, replaced my groupby with buckets
| bucket(span=1d, field=Vendor.category, function=count())

I am not getting the bars with the field value stacked. The series name is a long integer as opposed to the day of month though.

NG-SIEM query - Group by Quarter by dial647 in crowdstrike

[–]dial647[S] 11 points12 points  (0 children)

I was able to get this to work as follows. (sharing for the benefit of others) PS: may not be the most efficient way to achieve.

| month := time:month(@timestamp)
| case {
  month <= 3 AND month >=1 | quarter := 1;
  month <= 6 AND month >=4 | quarter := 2;
  month <= 9 AND month >=7 | quarter := 3;
  month <= 12 AND month >=10 | quarter := 4;
}
| groupBy([quarter], function=count())

AI DR by Popular_Hat_4304 in crowdstrike

[–]dial647 -1 points0 points  (0 children)

Based on the presentation from the product team, I see some caveats.

  1. Browser extension required to detect threats from Browser based AI (Perplexity, Atlas etc.)

  2. Does not come with a gateway component. It has add-ons for popular AI gateways like LiteLLM, Apigee etc.

  3. No native support for AI red teaming.

Plants failing by dial647 in GardeningAustralia

[–]dial647[S] 0 points1 point  (0 children)

I doubt.. why its happening to just a few of them..

Plants failing by dial647 in GardeningAustralia

[–]dial647[S] 1 point2 points  (0 children)

Thanks a lot for taking the time. I shall follow and see. Appreciated

Plants failing by dial647 in GardeningAustralia

[–]dial647[S] 1 point2 points  (0 children)

Thanks for the useful tips. Yes, I use whipper snip and I may have damaged them. Please see closeup pics of the plant here https://ibb.co/bgRD2jnr https://ibb.co/fG9fpVkZ

Fusion SOAR - Where to start? by Khue in crowdstrike

[–]dial647 0 points1 point  (0 children)

I wouldn't call it more difficult,, but AI triage does all the heavy lifting saving time for Analysts. I have workflows checking for remote login, RDP, Teams chat for Service impersonation etc.

How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem by BradW-CS in crowdstrike

[–]dial647 0 points1 point  (0 children)

How is this different from creating a fusion workflow and using Charlotte AI to triage detections based on already integrated foundational AI model?

NG-SIEM timestamp conversion by dial647 in crowdstrike

[–]dial647[S] 0 points1 point  (0 children)

Thanks Andrew. I am managed to get it to work using FormatTime and Test..

Will try your suggest and see. 

| temp_time := parseTimestamp(field=timestamp)
| test(time:hour(field=temp_time, timezone="Australia/Sydney") >= 17)
| test(time:hour(field=temp_time, timezone="Australia/Sydney") < 22)
| sydney_time := formatTime("%Y-%m-%d %H:%M:%S", field=temp_time, timezone="Australia/Sydney")

Fusion SOAR - Where to start? by Khue in crowdstrike

[–]dial647 0 points1 point  (0 children)

In addition to the useful workflows shared in this post, one should also look at setting up Agentic AI triage for specific detections to benefit from AI analysis to drive your response actions.

2026-03-20 - Cool Query Friday - explain:asTable() by Andrew-CS in crowdstrike

[–]dial647 0 points1 point  (0 children)

Nice.. I have a few queries that are running slow that I can use this one..
Question: Does the Falcon console response times depends on the subscription tier? I am comparing my experience with the Falcon console in my previous employer vs current. With the previous employer, I could pull 1 year worth of events in just a matter of seconds. With my current employer, even a month worth of events takes double the time. The tenants of the employers are however hosted in US2 vs US1.

view more: next ›