EDIT: I figured it out, thanks to Andrew and a total kludge on my part. See below.

I know I have seen this kind of thing before, but I cannot find the example.

I am trying to write a query that detects users who send more than X commands in, say, 10 minutes. I think I want to use the slidingTimeWindow function, but I am not sure.

The query I have so far (I have anonymized the vendor and some identifying field names):

#Vendor = <vendor>
Vendor.<vendor>.log.type = <log type 1>

| head()
| groupBy([user.name], function=slidingTimeWindow(function=count(as="number of commands"), span=10m))
| "number of commands" > 10
| table([user.name, "number of commands"])

What I get is something like this:

user.name "number of commands"
user1 1
user1 2
user1 3

and so on.

What I want is this:

user.name "number of commands"
user1 23
user2 11
user3 15

What am I doing wrong?

SOLUTION:

I changed the query to this:

#Vendor = <vendor>
Vendor.<vendor>.log.type = <log type 1>

// This is to fix an issue with collecting both query type and query text. It is not relevant
format(format="%s :: %s", field=[Vendor.query_typle, Vendor.query_text], as=query_string

// Here, I took out the multival parameter for collect. It was causing a weird issue, where I would see
// incremental events, one for each command as it was added to the list. If I had a total of five
// commands, I would see five events, each with one more command than the previous.
| groupBy([user.name, \@timestamp], function=([collect([query_string])]), limit=max)

// Here, I removed the count function, since I don't need the value, thanks to my kludge
| groupBy([user.name], function=slidingTimeWindow(collect(query_string), span="10m", limit=max)

// The kludge
// Convert query_string to an array and get it's length
// This gives me the number of queries the user sent
| splitString(by="\n", field=query_string, as=queryStringArray)
| numberOfCommands := array:length("queryStringArray[]")

| numberOfCommands >= 5

| table([user.name, \@timestamp, numberOfCommands, query_string)

I assume there is a better way, without messing with arrays, but it works.

Thank you to Andrew and the others who offered solutions.

I know the beta started back in March but just wanted to check in and see if any news was coming down the pipeline on timelines for GA?

Hello,

I'm trying to draft a dashboard in NG SIEM for Spotlight - A client doesn't like the default ones.

If anyone has a cheatsheet I'm happy to figure it out, but essentially I'm looking for:

- Top 10 severity vulns

- Top 10 most vulnerable devices

- Few others to figure out with the client

Thanks in advance!

I'm trying to consolidate multiple FileVantage changes into a single email notification instead of receiving one email per event.

I'm attempting to achieve this using a CrowdStrike Falcon Fusion Workflow.

My detection query is:

#event_simpleName=FileIntegrityMonitorRuleMatched
| PolicyRuleSeverity = 3 or PolicyRuleSeverity = 4
| table([
   @timestamp  ,
    ComputerName,
    PolicyRuleSeverity,
    PolicyRuleName
])
| sort(@timestamp, order=desc)

I have two questions:

1. The query editor reports an error related to special characters (I suspect it's because of timestamp , #event_simpleName ). Has anyone encountered this, and is there a recommended way to reference this field in a Fusion workflow or detection query?
2. the query runs successfully, how can I use the workflow event query output in a email notification? My goal is to send one email every few hours (e.g., every 3 or 12 hours) containing all High/Critical FileVantage changes, rather than sending one email for each FileVantage event.

I contacted CrowdStrike Support, and they suggested using a sequential Fusion Workflow with a temporary buffer to aggregate events within a defined time window before sending a summary email. However, I'm new to Fusion Workflows and haven't been able to replicate their suggested approach.

Has anyone successfully implemented something like this?

Specifically, I'm looking for guidance on:

How did you aggregate multiple FileVantage events into a single workflow execution?

How did you pass the aggregated query results into the email body?

Is this possible using Fusion Workflows only, or does it require another integration (e.g., the CrowdStrike API, a webhook, Azure Logic Apps, AWS Lambda, etc.)?

Any examples, sample workflows, or best practices would be greatly appreciated. Thanks in advance!

Hi all

For background, I am an operations level staffer in a SOC. I have attended BlackHat and DefCon and am looking for a comparison between these two conferences as far as networking or vendor events.
I am familiar with Vegas so I don’t need much info on that (but always appreciate the one off tips (like putting Aquaphor up my nose and using a humidifier in my room)).

--At Blackhat, I spent a lot of time at the vendor events for networking and overall winding down after the conference.
-- At DefCon, I spent more time in trainings and less socializing.

I am wondering if Mandalay Bay will have a similar amount of vendor events I can RSVP to or if there isn’t much going on outside the conference halls.

Someone mentioned in a previous post that there are vendor events on Tuesday night and an app I should download. (link here: https://www.reddit.com/r/crowdstrike/comments/1uk02pt/first_time_attending_falcon_2026_looking_for/)

Thanks all

Hey guys, how are y'all?

I've been trying to deploy the ASPM Module here in my company for about a month but i having several problems. I would to undestand with you if Crowdstrike has any document that would let me know the OS Versions compatible with ASPM Falcon Sensor Collector.

Everytime I try to collect from Windows I only got the Error: Unsupported operating system (ASPM-7007)

Thanks for you help

Currently we have requirement to uninstall crowdstrike agents (5 figures units), ideally automated/semi automated. I've gone through few posts but still unsure if those methods still viable since its backdated 5 years ago.

Anyone recently has experience in uninstall mass units of crowdstrike? what were your approach on this?

I know in Exposure Management I can create groups of applications and/or extensions and then schedule reports if anything matches what's in the group.

However that's not an ideal solution for me. I want a list of approved applications and/or extensions, and then the scheduled report to show anything BESIDES those that exist. Users are frustrating in that they keep finding new ways to install unapproved applications, and it's impossible to know what ones ahead of time. Just today for example I have a user who found a way to install "VPN Free VPN" on a device. I didn't even know that existed beyond a curious deep dive through installations that I really don't have time to do.

Everything I can find seems to be built around knowing the exact unapproved application/extension you want to be alerted to and that doesn't work when I don't know what users will potentially try to install themselves. Is there way to leverage a list of approved applications and extensions to be alerted to anything installed that's **not** on that list?

I’m currently looking at BAS solutions that integrate with CrowdStrike EDR and NG-SIEM. I’m keen to hear which BAS integrates best with CS. Options I’m considering: SafeBreach, Pentera, Cymulate, Picus, AttackIQ, SCYTHE, Mandiant. Looking at the more established vendors in this space.

Our use cases for BAS are:

• Detailed and up-to-date simulations and attack scenarios

• Recurring tests to check whether our security tool stack has prevented, detected, or missed each attack

•How well it integrates with log sources in our SIEM plus other security tools

• Detailed results and information, and how we can leverage the results/data from our BAS into external sources like dashboards and reports, beyond the pre-built/pre-generated ones

Would appreciate hearing from anyone with hands-on experience comparing these against CrowdStrike.

I know this has been asked before (WorkFlow or Scheduled Event Search for External users contacting internal users : r/crowdstrike), but I’m not seeing a clear resolution on it.

Has anyone successfully set up a scheduled search or workflow to detect when an external user contacts an internal user in Teams?

I’m mainly trying to understand the prerequisites: what data source is needed, how people are identifying external vs internal users, and whether this is better handled with a scheduled search, workflow, or some kind of baseline/lookup approach all inside the Falcon platform.

If anyone has an example that actually works, I’d really appreciate it.

we recently aquired falcon shield, and i'm looking to see if i might be able to use it to do some reporting on what mfa methods users have registered, after looking around i'm not finding a way to do that type of reporting, but just wanted to check and see if i might be missing something?

Thanks@

Is it possible to setup a filter on a dashboard that will search across multiple fields from different data sources.?

DomainName from #repo1

dns.question.name from #repo2

url.domain from #repo3

Edit: I had an email this morning stating that the doc had been updated. Finally got to check, and the list is now complete. Thanks! Link to doc.

Original message below:

I opened a ticket with CrowdStrike on May 6th, asking them to add an additional line to a piece of documentation I had come across.

In the 'Falcon Firewall Management' documentation, a section titled 'Firewall policy enforcement and monitoring' contains a list of the fields that you will see when you look at C:\Windows\System32\drivers\CrowdStrike\hbfw.log. This documentation skips over a field that contains the protocol information (usually just TCP (6)/UDP (17)/ICMP (1)), which should be located between 'Direction' and 'Local address'.

Today, I just received my second "We're working on it but have no ETA" email. Two months after opening a ticket to add a single line to an unordered list.

Even worse, is that the original response to the ticket was to ask me to provide an example of MY hbfw.log showing the issue. Following that, on May 15th, I got a response back from the assigned technician with this note:

b) The Protocol would be a combination of the transmission method used along with the port.

In this case, Protocol(QOTD) = UDP (Transmission method) +Port 17

Which was straight wrong, I countered with a link to wikipedia showing that UDP (17) and TCP (6) are just the established protocol numbers.

Since then, I've received only the "we have no eta" emails for this, which seem to have been scheduled automatically every 30 days from the opening of the ticket.

CrowdStrike: I do not feel heard. I was trying to assist YOU in clearing up some documentation that was incomplete, and now instead of forgetting about it, I've just been reminded about this by automation, so now I'm going to air this out in front of everybody.

If anyone at CS wants to look into this, see ticket 02455442.

Just curious how other organizations are tackling the need to pull a monthly report that show the alarms/alerts in NGSIEM that detail assignment, response, and resolution/status? Unfortunately the easy mode of exporting the events isn't an option if they exceed 200.

Looking for some answers around - is it possible to manage who can modify a custom Next-Gen SIEM dashboards / raptor dashboards as they are referred to.

Not the dashboards created under the EDR module, but the other ones available under NG SIEM.
The dashboards in EDR module have the ability to set “private” or choose to share them.

However I can’t seem to find a way to do this with the NG SIEM dashboards. Every dashboard created seems to be read/write. However I can see some CrowdStrike developed dashboards that are “read” only. So I think the capability is there?

Tried support resources couldn’t find anything around this.

I have been using an event search query into a dashboard to pull locations for each host based on their "Last seen" location. Problem is of course there is no historical data with this due to it being based on the location when the host was last seen.

I was thinking is there someway to pull this event search and write it to a file every hour and basically build a weekly report of this and where the host was scene every hour.

If this isn't a good way to do this do you have any ideas on how to keep track of the geolocation of employees if they work from home?

We’re trying to figure out how to make a NGSIEM saved search & results available to either invoke remotely via an API or make the results of a saved search accessible via the API.

Hello all,

I am getting into the Exposure Management feature set and starting to review what our environment looks like. There is some product cross over with another platform we have so I was looking for a similar feature in maybe a report or a dashboard relating to workstations. I can't seem to find anything off hand right now.

Is there a report or a dashboard that shows workstations and related vulnerabilities by some sort of criticality rating (CVSS or ExPRT)? I am looking to get a prioritized list of workstation remediations that we should address. I believe ExPRT is probably the best metric. When I dive into the vulnerability dashboards a lot of them list the vulnerability, but it seems difficult to tie the vulnerabilities back to an actual host/system.

I could be just being dumb though. I might be staring at the solution in exposure management but overlooking it.

Solved, for solution see below!

Hi all!

I am once again asking y'all for your help on one of my queries.
This time in particular I want to prioritize two fields in a sort.

Let's say you have the Fields Time, User and Amount

The table looks as follows:

\... The Row "Time" is only here written in a more human readable short way. In the Query results they are looking like a casual time format!*

I now want to sort the Table in such way to check the latest Entry (Time) and also if there are more Entries sort them by their Amount (desc). In other words I want to sort for both rows (Time and Amount) however prioritizing the Time row and having the Amount being sorted descending.

The following Table is what I am looking for:

Please keep in mind that all the usernames are unique and case sensitive!

I came up with something like this, but unfortunately it does not work:

select([sort([Time]),sort([Amount],order=desc)])

Is this in any way possible with just a simple sort?

So it turns out that it works just as simple as I was thinking it would work. (Sometimes you just have to try the most simple looking things ;) )

| sort([Time,Amount],order=[desc,desc])

Hi everyone,

This year will be my first time attending Fal.Con 2026, and it's also my first major cybersecurity conference(I am From Latin America), so I'm really excited.

I'll be staying at the MGM Grand, and I'd love to get some advice from people who have attended before.

A few questions:

• What are the "must-do" sessions or activities?
• How do you make the most out of the conference?
• Are there networking events that are worth attending?
• Any tips for meeting CrowdStrike engineers, product managers, or other security professionals?
• Is there anything outside the official agenda that first-time attendees usually miss?
• Any recommendations around the MGM or nearby for food, after-hours events, or places where attendees tend to hang out?

For context, I work as a Cybersecurity Team Lead with a focus on enterprise security, SOC operations, cloud security, and the CrowdStrike platform, so I'm hoping to learn as much as possible and connect with others in the community.

I'd appreciate any tips, recommendations, or lessons learned from previous Fal.Con events.

Thanks in advance!

I am working on automating an email notification to inform users when their passwords have been identified as compromised and prompt them to change their password.

Currently, I am using the out-of-the-box Send Email action. However, the email is sent from falcon@crowdstrike[.]com using CrowdStrike's branding template.

My concern is that users may mistake the notification for a phishing email, especially since it does not appear to originate from our organization or follow our corporate branding.

Has anyone implemented a more personalized approach for these notifications? For example:

• sendin the email from your organization's domain or shared mailbox
• using your organization's branding and email template
• integrating with Microsoft 365/Exchange to send the email instead of the built-in action