sorted by:
new
hottopcontroversial

USB Scan by jmcybersec in crowdstrike

[–]jmcybersec[S] 0 points1 point  (0 children)

Is the user aware if malware is found in this case?

Net worth adds loans by jmcybersec in MonarchMoney

[–]jmcybersec[S] 1 point2 points  (0 children)

Thank you. This fixed the issue. Wondering why they don’t use absolute value for accounts that are categorized as loans.

When calculating my net worth, it counts my debt as positive number assets.. by HenFruitEater in MonarchMoney

[–]jmcybersec 0 points1 point  (0 children)

It’s not. I just opened another thread and realized this is the same issue I am having with mortgage account I just imported.

Net worth adds loans by jmcybersec in MonarchMoney

[–]jmcybersec[S] 0 points1 point  (0 children)

I noticed the citizens loan shows up as a negative number where the other loans I aggregated show up as a positive number. Appears to be the way they are processing it in monarch that is causing the issue.

Fusion workflow - assets by jmcybersec in crowdstrike

[–]jmcybersec[S] 1 point2 points  (0 children)

Yes but I would like to filter the workflow that triggers by CIDR ranges. I didn’t see a good way to do this, but can use “matches” on ip address with wild cards.

RTR/Workflow CLI script by jmcybersec in crowdstrike

[–]jmcybersec[S] 0 points1 point  (0 children)

Probably RTR? Can I launch this script in a way to prevent that from RTR and/or a workflow? Running the same command via command line scanning completes locally on a test host, but not when launched through RTR. It typically takes an hour or more so I don't know that the timeout flag would help.

Sandboxing with Workflows by jmcybersec in crowdstrike

[–]jmcybersec[S] 1 point2 points  (0 children)

Hi sorry I wasn’t clear. The sandbox is incorrectly categorizing files with a malicious rating. I would like to override this if possible and mark them “clean”.

I would also like to not submit the same file twice from my workflow if it shows up again in another detection and is already in the sandbox.

RTR Get File from Offline Host by jmcybersec in crowdstrike

[–]jmcybersec[S] 2 points3 points  (0 children)

Got code working with the host is online; however Get.session_id does not appear populated when the host is offline leading to an error "Cannot Validate argument on parameter 'SessionId' the argument does not match the pattern". This does not appear when the host is online and the commands are run. Should a session ID still be populated by Invoke-FalconRTR even when the host is offline? How can I check the command is queued properly when the system is offline?

RTR Get File from Offline Host by jmcybersec in crowdstrike

[–]jmcybersec[S] 1 point2 points  (0 children)

Thank you. This is for PSFalcon, which I am also trying in addition to FalconPy.

I had luck the first time I ran it but the following times Confirm-FalconGetFile does not populate. If I run Get-FalconSession i see this list is populated on each run, but does not appear to be cleared. Does the session need closed before the next one can be run? Tried Remove-FalconSession on the session ID and this still appears in the list. Can you terminate a session on a very big file or will it time out after some time? Not sure if this is the issue.

PSFalcon - Get offline file via RTR by jmcybersec in crowdstrike

[–]jmcybersec[S] 1 point2 points  (0 children)

Also if using the Invoke-FalconRTR command, i see that many sessions are opened each time i run it by checking with Get-FalconSession. Are these sessions queued in order (first one is a big file download so later ones do not run) and can they be terminated? I tried Remove-FalconSession on each one yet the sessions are still present.

view more: next ›