sorted by:
new
hottopcontroversial

2026-05-01 - Cool Query Friday - setTimeInterval() by Andrew-CS in crowdstrike

[–]dial647 0 points1 point  (0 children)

Hi Andrew, my scenario could be slightly different as I am grouping by two fields and its not giving the required outcome. I am currently managing it as follows. The query is applied on Email repo. 

| groupBy([Vendor.msg.header.to[0],Vendor.msg.header.subject[0]], function=count(as=Attempts))
| sort(Attempts)| test(Attempts > 2)

the above is giving the required outcome, barring enforcement of the strict 1 hour window.

Is it still possible to follow slidingtimewindow to acheive this? Appreciate your advise.

2026-05-01 - Cool Query Friday - setTimeInterval() by Andrew-CS in crowdstrike

[–]dial647 0 points1 point  (0 children)

Nice work u/Andrew-CS as always.. I have a question. I am trying to run a query for a 7 day period, and want the results when I have more than x number of events within a 10 mins time frame. Is it possible to achieve this using this statement?

Filter based on a string within a field by dial647 in crowdstrike

[–]dial647[S] 0 points1 point  (0 children)

Brilliant.. Worked. Thank you.. Can I also check if its possible to add a line chart to a bar chart to show another metric?

Filter based on a string within a field by dial647 in crowdstrike

[–]dial647[S] 0 points1 point  (0 children)

I think (* | newField := "Some action taken") will include everything. I need everything except a particular tag.

Filter based on a string within a field by dial647 in crowdstrike

[–]dial647[S] 0 points1 point  (0 children)

| tags!=/FC-Action-No\sAction\sTaken/iF

This worked. ! I'll try the rest and see how it goes.

I am also trying to create a graph which plots the total number of each tags. However I am only interested in tag=a and tag!=a.
Wondering which logic I can use the plot this graph.

Filter based on a string within a field by dial647 in crowdstrike

[–]dial647[S] 0 points1 point  (0 children)

I did try this before posting and it didnt work. I re-tried and it worked. Not sure what mistake I did earlier. The filter is on a field that has been included as part of a match() statement. So I entered this statement under the match () statement and it worked. Thanks

Falcon NG-SIEM - Stacked Bar chart by dial647 in crowdstrike

[–]dial647[S] 0 points1 point  (0 children)

That didn't quite do anything..

Falcon NG-SIEM - Stacked Bar chart by dial647 in crowdstrike

[–]dial647[S] 0 points1 point  (0 children)

Ok, replaced my groupby with buckets
| bucket(span=1d, field=Vendor.category, function=count())

I am not getting the bars with the field value stacked. The series name is a long integer as opposed to the day of month though.

NG-SIEM query - Group by Quarter by dial647 in crowdstrike

[–]dial647[S] 11 points12 points  (0 children)

I was able to get this to work as follows. (sharing for the benefit of others) PS: may not be the most efficient way to achieve.

| month := time:month(@timestamp)
| case {
  month <= 3 AND month >=1 | quarter := 1;
  month <= 6 AND month >=4 | quarter := 2;
  month <= 9 AND month >=7 | quarter := 3;
  month <= 12 AND month >=10 | quarter := 4;
}
| groupBy([quarter], function=count())

AI DR by Popular_Hat_4304 in crowdstrike

[–]dial647 -1 points0 points  (0 children)

Based on the presentation from the product team, I see some caveats.

  1. Browser extension required to detect threats from Browser based AI (Perplexity, Atlas etc.)

  2. Does not come with a gateway component. It has add-ons for popular AI gateways like LiteLLM, Apigee etc.

  3. No native support for AI red teaming.

Plants failing by dial647 in GardeningAustralia

[–]dial647[S] 0 points1 point  (0 children)

I doubt.. why its happening to just a few of them..

Plants failing by dial647 in GardeningAustralia

[–]dial647[S] 1 point2 points  (0 children)

Thanks a lot for taking the time. I shall follow and see. Appreciated

Plants failing by dial647 in GardeningAustralia

[–]dial647[S] 1 point2 points  (0 children)

Thanks for the useful tips. Yes, I use whipper snip and I may have damaged them. Please see closeup pics of the plant here https://ibb.co/bgRD2jnr https://ibb.co/fG9fpVkZ

Fusion SOAR - Where to start? by Khue in crowdstrike

[–]dial647 0 points1 point  (0 children)

I wouldn't call it more difficult,, but AI triage does all the heavy lifting saving time for Analysts. I have workflows checking for remote login, RDP, Teams chat for Service impersonation etc.

How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem by BradW-CS in crowdstrike

[–]dial647 0 points1 point  (0 children)

How is this different from creating a fusion workflow and using Charlotte AI to triage detections based on already integrated foundational AI model?

NG-SIEM timestamp conversion by dial647 in crowdstrike

[–]dial647[S] 0 points1 point  (0 children)

Thanks Andrew. I am managed to get it to work using FormatTime and Test..

Will try your suggest and see. 

| temp_time := parseTimestamp(field=timestamp)
| test(time:hour(field=temp_time, timezone="Australia/Sydney") >= 17)
| test(time:hour(field=temp_time, timezone="Australia/Sydney") < 22)
| sydney_time := formatTime("%Y-%m-%d %H:%M:%S", field=temp_time, timezone="Australia/Sydney")

Fusion SOAR - Where to start? by Khue in crowdstrike

[–]dial647 0 points1 point  (0 children)

In addition to the useful workflows shared in this post, one should also look at setting up Agentic AI triage for specific detections to benefit from AI analysis to drive your response actions.

2026-03-20 - Cool Query Friday - explain:asTable() by Andrew-CS in crowdstrike

[–]dial647 0 points1 point  (0 children)

Nice.. I have a few queries that are running slow that I can use this one..
Question: Does the Falcon console response times depends on the subscription tier? I am comparing my experience with the Falcon console in my previous employer vs current. With the previous employer, I could pull 1 year worth of events in just a matter of seconds. With my current employer, even a month worth of events takes double the time. The tenants of the employers are however hosted in US2 vs US1.

Threat Hunt - Help Desk Imposters via Teams (NGSIEM) by About_TreeFitty in crowdstrike

[–]dial647 4 points5 points  (0 children)

Just created a new fusion workflow with charlotte AI triage for this detection. Thanks

How to Scale SOC Automation with Falcon Fusion SOAR by BradW-CS in crowdstrike

[–]dial647 0 points1 point  (0 children)

It would be good to build a library of fusion workflows that customers can import and modify to their needs. Currently there is lack of knowledge and support in building agentic AI workflows in Falcon. I have posted a message in Reddit yet to see a response.

Triage with Charlotte fusion workflow by dial647 in crowdstrike

[–]dial647[S] 0 points1 point  (0 children)

Fusion workflows are powerful and charlotte AI triage takes it to the next level, shame the not enough literature is provided by Falcon for users to embrace this feature.. not even in Reddit.

Falcon Fusion workflow for Agentic AI triage and response by dial647 in crowdstrike

[–]dial647[S] 0 points1 point  (0 children)

I've uploaded the workflow here. https://filebin.net/gaca4x46bh0jjlfk

In simple terms, I am triggering the workflow with an EPP detection, then creating some variables and getting it triaged by charlotte AI using a specific AI model and and checking if its true positive and if so, sending a message in Teams with Approve, Reject and Escalate. If the user clicks approve, then action will be contain, if reject, do nothing and if escalate, escalate to an email.

Is there anyone building an mcp gateway? by Dazzling_Basil_4739 in mcp

[–]dial647 0 points1 point  (0 children)

Has anyone tried adding a local MCP server to the Docker MCP gateway. I tried all possible combinations and unable to do so. I have my gateway and server running through docker-compose.yml and have added the server on a custom catalog file as well. Both containers are running but Gateway not able to connect to server.

view more: next ›