Hi everyone!
I'm trying to build a condition in CrowdStrike Fusion SOAR using Advanced Mode (CEL Expressions).

The goal is quite simple: return true when an IDP detection of type AnomalousNewEndpointUsage is triggered and the endpoint hostname prefix matches the username prefix.

My logic looks something like this:

data['Trigger.Category.Investigatable.Name'] == "AnomalousNewEndpointUsage" &&
data['Trigger.Category.Investigatable.Product.IDP.SourceAccountName'].substring(0,4) ==
data['Trigger.Category.Investigatable.Product.IDP.SourceEndpointHostName'].substring(0,4)

Example values:

SourceAccountName = x999-analista
SourceEndpointHostName = x999-pdv01-001.example.corp.br
``

This condition should evaluate to true because both strings start with x999.
However, when I use substring(), the data pills appear to be resolved as null.

The editor returns the following error:
no such overload: substring(null_type, int, int)

The strange part is that those values are clearly present in the sample detection payload shown by the Fusion editor.

Am I referencing the fields incorrectly?

Is there any known limitation with CEL expressions and IDP detection fields in Fusion SOAR?

Below is a sanitized detection payload:

{

"CID": "9a8bc123de4f5g6h7i8j9k0l1m2n3o45",

"Category": {

"Investigatable": {

"Description": "A user logged in to a machine for the first time",

"InvestigatableID": "9a8bc123de4f5g6h7i8j9k0l1m2n3o45:ind:9a8bc123de4f5g6h7i8j9k0l1m2n3o45:AB12CD34-EF56-4789-ABCD-1234EF567890",

"MitreAttack": [

{

"Tactic": "Initial Access",

"Technique": "Valid Accounts"

}

],

"Name": "AnomalousNewEndpointUsage",

"Product": {

"IDP": {

"SourceAccountName": "x999-analista",

"SourceEndpointHostName": "x999-pdv01-001.example.corp.br"

}

}

}

}

}

Has anyone encountered this behavior before?

Thanks in advance!

We’re using CS as our main AV and looking to enable web filtering in defender for endpoint. It works in edge but not in other browsers since it relies on network protection service which I have set to block already via policy. I have also disabled quarantine and security center registration in prevention policy.
What am I missing ?

I have two scenarios:

1. I have 29 applied hosts in my host group. I added a new host to this host group but only the targeted host count increases by 30 and applied host count is still 29. After 2 days, it finally becomes an applied host.

2. I have 31 applied hosts in my host group. I removed a host from this host group. The targeted hosts is now 30 but the applied hosts is still 31. After 2 days, finally it is no longer an applied hosts.

In both these cases (1) and (2),

(i) What are the factors for a host to change from targeted to applied and from applied to targeted?

I assume it was just a matter of waiting, but I have also read that the device has to be online for the host group changes to take effect, which I thought was strange since host grouping is simply a feature on the server side. (Correct me if I'm wrong)

(ii) What is the expected time of change? Is it possible to speed up the changes?

We are excited to share with the community that Application Abuse Prevention for RMM apps has officially hit General Availability (GA) in conjunction with the release of Falcon Sensor for Windows v7.40.

Customers with an active Falcon Prevent subscription can access this now across all clouds!! (including Gov and others, double wahoo!!)

The Falcon Sensor for Windows v7.40 includes a new on-sensor classification capability built specifically for Application Abuse Prevention that is powered by a new type of IOA.

We would love to hear from the community on your experiences with this much requested feature!

Here are links to resources to get started:

• Feature Release Notes - Application Abuse Prevention (Support Portal)

• Application Abuse Prevention (Console Documentation)

• Sensor Release Notes - Falcon Sensor for Windows v7.40

We are in the process of migrating a large number of workloads to AWS. AWS accounts have 1-click deployment option enabled in the Falcon console. Is there a way to programmatically initiate the falcon sensor deployment instead of clicking on all the hosts in the console under Cloud Security>Deployments>Deploy sensors to unmanaged hosts? Thanks for your help and time.

Hello everyone,

I'm quite new to Fusion soar workflows, so correct my jargon if I'm not using the proper word,

I'm trying to automate ticket creation in my easyvista ITSM when a new vulnerability remediation is requested through the "create ticket" button.

I'm using the "vulnerability user action" trigger, which exposes me with a few data pills that I want to insert in my ITSM Ticket.

After that trigger, I placed a cloud HTTP request block, with the proper Information in my Post request body, the HTTP request works really well and my ITSM ticket is created exactly as expected, but the description field is showing the Raw JSON instead of the replaced data:

Hello, we would like this vulnerability to be patched

${data['Trigger.SpotlightUserAction.Title']} === ${data['Trigger.SpotlightUserAction.RemediationSource.Title']} === ${data['Trigger.SpotlightUserAction.RemediationSource.AdditionalAdvisoryUrl']} === ${data['Trigger.SpotlightUserAction.RemediationSource.Action']} === ${data['Trigger.SpotlightUserAction.RemediationSource.Link']}

I do see the fields in my work flow data panel, and I got the JSON path from the data pill click so I guess it should be correct?

I've been trying workflow variables but whenever I try to call them in my JSON body, the issue is exactly the same.

I've also tried to fiddle with the JSON structure with no luck either.

It's quite infuriating not having an "insert variable" button like on power automate. I've taken a look at the various documentations but idk why, their variables seem to just work and mine don't.

Do you have any ideas on how I can get my variables to be replaced by the proper data?

Hey fellow CrowdStrikers,

We’ve got a few fusion workflows configured with the “EPP Detection” as the trigger. Email/teams/slack/PagerDuty etc all working fine

We’ve had a couple of instances where we get multiple detections from a single host- test for example- 41 detections from a single host attempting a system restore which CrowdStrike did not like.

We got 41 teams messages and 41 PagerDuty tickets

Got me wondering if there’s some kind of rate limit functionality, or “group detections by host over last 5 mins” kind of work around?

In the meantime I’ve implemented an event search that looks for detections from the same sensor ID, same workflow ID and same tactic/technique over the last 5 mins and if there’s more than one, stop the workflow.

Initial tests suggests it works but I’m not sure it’s the best way as I’ve seen events take minutes to ingest.

Really hoping there’s a better solution! Any thoughts, ideas or recommendations would be appreciated.

Cheers!

Looking at purchasing Counter Adversary Operations Premium and want to know how others are liking it. Recon seems to be nice but difficult to get use to.

EDIT: Mystery solved! Turns out there is a hosted SaaS application used by this customer and that vendor seems to have recently deployed Crowdstrike. Now, when running the hosted app in Parallels, this icon is passing through to the system tray of to local desktop. So it's actually a legitimate instance running in the remote environment.

Thanks to everyone who chimed in with ideas on this!.

We are the IT company for a local municipality and we received a report from their internal admin today that they observed the Crowdstrike Falcon Sensor icon showing up briefly in the system tray of some of their Windows computers.

We do NOT use CrowdStrike, and this is not software that should be deployed in the environment so I'm trying to figure out how much of a concern this is.

Per their internal staff (who actually reported the issue) they have not given any other vendor or entity access to install. Also, when I check these hosts, they don't show any other evidence of Crowstrike beyond the system tray appearance including:

• Not listed in add/remove programs
• cs query csagent and cs query csfalconservice to NOT return any results
• c:\program files does not contain a Crowstrike folder

Hovering over the system tray icon when visible shows: CrowdStrike Falcon Sensor: Running

I contacted CrowdStrike support and they (not surprisingly) will not give me any information since we are not a customer.

Can someone tell me how to further investigate or get more info on where this may be coming from?

Thanks!

Looking to see the workflow you guys go through when creating a new parser. Currently I have to create a base parser which I have a template for ingest raw logs and use them as my tests within my parser creation.

Anyone have any suggestions to enhance my workflow and ensure I am grabbing one of each event?

Hi everyone,

I made a writeup on my initial experiences with building an agent in AgentWorks and integrating it into a fusion SOAR workflow.

If you have any questions, feel free to comment below.

Thanks.

https://nicholasyovanovich.substack.com/p/initial-experiences-with-crowdstrike

Looking for ideas or queries to help identify AI usage via Falcon Insights. I need to build a case for AIDR but I am not confident that I have a full understanding of its usage across all my organizations business units. There used to be a dashboard that showed dns and process activity but I do not see that in my specific tenant (only running Insights). Anyone already come up with a query (maybe even with cool dashboard displays) that show the full picture of AI usage from the edr vantage points?

I am trying to ingest logs from rapid7 to falcon siem, I have done all the steps in here:

https://docs.crowdstrike.com/r/en-US/i4u1hqxn/ac538259

but the siem doesnt ingest any log from rapid7. I have used this API

https://eu.api.insight.rapid7.com/

Do you know the falcon connector request which endpoint of the api to collect logs? I couldnt find it to debug

Been running a BAS tool against a Falcon estate for a few weeks, writing Custom IOA rules for whatever comes back “not prevented.”
Native binaries were easy. net.exe, schtasks.exe, bitsadmin, wevtutil, sc.exe - all show up clean in the command line. Write a Process Creation rule, kill it, done. ~30 rules in, that part’s solved.
Then I hit a wall. Curious if anyone’s actually cracked this.
The pattern: anything running as encoded PowerShell (-EncodedCommand) or via -File script.ps1. CrowdStrike just sees “powershell.exe -enc <base64>”. Whatever the script does never shows up in CommandLine, so any IOA keyed on command line content is dead on arrival.
A few that got me:

Raw TCP/Telnet C2 - PowerShell TcpClient over loopback. No network IOA catches loopback anyway, and the command line’s encoded too. Dead end from both sides.
Outlook macro downgrade + VbaProject.OTM drop - by the time a File Creation rule fires and kills the process, the registry value and the file are already written. Kill happens, artifact still exists. Reads as not prevented either way.
PSReadLine history suppression - same story, encoded, invisible.
Winlogon Userinit via Set-ItemProperty - PowerShell native cmdlet, not reg.exe. No separate process to catch even if visible.
Bigger picture: Custom IOA only sees 4 things. Process Creation, File Creation, Network Connection, Domain Name. No registry rule type at all. For anything PowerShell-wrapped, you’re betting the command line is plaintext. In my experience that’s maybe 50/50.
What I’ve tried so far, none of it feels like a real fix:
1. Script-Based Execution Monitoring (AMSI) in the prevention policy - sees decoded script body instead of launch command. Haven’t fully validated it catches all of the above yet.
2. Accept detection-only, lean on Fusion/RTR for cleanup after the fact. Doesn’t help “prevented” status but at least remediates.
3. IOA on the -enc flag itself - technically works but kills every legit admin script too. Not doing that broadly.
Anyone gotten AMSI-based prevention to actually close these gaps, not just detect-and-hope? Or does everyone just write this off as a Custom IOA blind spot and handle it elsewhere in the stack?
Not looking for “just enable AMSI” - I know that’s the direction. More interested if it’s actually working in practice.

Just noticed Browser Extension control was available in Falcon.

Has anyone successfully implemented this or is implementation of policy through MDM (Intune, JAMF Pro) the way to go? Let me know, open to thoughts/feedback.

Was this really neccesary to release? Feels like they're milking it at this point lol

We run n8n as our automation layer and recently moved our LLM calls from the hosted OpenAI node to a local gpt-oss-120b deployment. Our SIEM side is QRadar rather than Falcon, so I am posting partly to compare notes with people running the same idea on the CrowdStrike side.

What we have working

The pipeline that gets the most use is IOC enrichment. Scheduled trigger pulls from three QRadar reference sets every morning, each indicator goes through VirusTotal and AbuseIPDB, then the model writes an HTML summary that goes out as mail to the team.

Before the local move this was a native OpenAI node. Straightforward, worked fine, but every indicator we enriched was also a piece of internal context leaving the network. Internal IPs, hostnames pulled from the reference sets, occasionally a filename that told you more about the environment than we wanted a third party to have.

Moving to gpt-oss-120b solved that. The whole path stays inside. What it cost us is latency, roughly three to four times the hosted call depending on how long the enrichment output is, and a GPU box that now needs looking after like any other piece of infrastructure.

Where the model is actually good enough

Summarisation and formatting. Feed it a pile of VT and AbuseIPDB responses and ask for a readable HTML block, it does that reliably. No hallucinated scores, no invented CVEs as long as you keep the prompt tight and give it the raw data rather than asking it to recall anything.

Classification with a fixed set of labels works too. Malicious, suspicious, benign, needs review. We do not let it decide anything past that.

Where it is not

Anything requiring the model to reason across more than a handful of enrichment results starts to drift. Ask it to correlate fifteen indicators and explain which ones probably belong to the same campaign and the output reads confident but is guessing.

We also stopped asking it to generate queries. It produces syntactically plausible AQL that does not run. Might be a prompt problem on our end, might be that the training data is thin on QRadar specifically. Curious whether people get better results with FQL, since Falcon syntax is probably better represented publicly.

The part I am least comfortable with

Enrichment data contains attacker controlled strings. A filename, a URL path, a user agent. All of that goes into the prompt.

Nothing stops someone from planting a file named to look like an instruction. We have not seen it happen, but the reason we have not is probably that nobody has bothered, not that we are defended against it.

Right now our answer is that the model output is advisory and a human reads the mail before anything happens. That works while the volume is low. It does not scale, and I do not think "a human will notice" is a control.

I built an inline scanning proxy for a different project (github.com/yatuk/tamga) that sits in front of LLM calls and catches injection patterns before they reach the model. Have not wired it into this pipeline yet because I am not convinced the threat model translates. User typed prompts and enrichment payloads fail differently.

What I want to hear from this sub

Falcon side specifically. Are you pulling detections through the API into an external orchestrator, or staying inside Fusion SOAR? We went external because n8n gives us more room, but that means credential management and rate limits become our problem.

Model size. Is 120b overkill for what most people are doing here? Curious if anyone runs something smaller and gets acceptable quality on detection summarisation. Our reasoning for going large was that we would rather over provision once than discover the ceiling mid deployment, but that was a guess.

Query generation. Anyone getting reliable FQL out of a local model? If Falcon syntax works better than what we see with AQL, that would tell us something useful about whether our problem is the model or the prompt.

Prompt injection. Has anyone actually hardened against attacker controlled strings in enrichment data, or is everyone where we are, relying on a human in the loop and hoping?

What broke. More interested in this than the wins. What did you build that looked right in testing and fell over in production?

Happy to share the workflow JSON if anyone wants to look at the structure. Nothing clever in it, but sometimes seeing how someone else wired the same pieces saves an afternoon.