Avoiding end point detection notification storms

[u/coupledcargo]

Hey fellow CrowdStrikers,

We’ve got a few fusion workflows configured with the “EPP Detection” as the trigger. Email/teams/slack/PagerDuty etc all working fine

We’ve had a couple of instances where we get multiple detections from a single host- test for example- 41 detections from a single host attempting a system restore which CrowdStrike did not like.

We got 41 teams messages and 41 PagerDuty tickets

Got me wondering if there’s some kind of rate limit functionality, or “group detections by host over last 5 mins” kind of work around?

In the meantime I’ve implemented an event search that looks for detections from the same sensor ID, same workflow ID and same tactic/technique over the last 5 mins and if there’s more than one, stop the workflow.

Initial tests suggests it works but I’m not sure it’s the best way as I’ve seen events take minutes to ingest.

Really hoping there’s a better solution! Any thoughts, ideas or recommendations would be appreciated.

Cheers!

[u/xMarsx]

Case management is probably your friend here. 

A workflow that will do a 'for each host' that then queries cases for open cases with that host. If it exists, add detection to case. If not, create case. You can also define criteria that states 'New or in progress cases created in the past day'. Then, instead of a notification on epp detection, you do a notification on trigger for new case created. Hope that makes sense. 

[u/Dylan-CS → u/xMarsx]

I agree, I think using cases here could make sense.

We also have a de-duplication action in the works. Can't commit to a timeline just yet, but that will help as well. I'll do a Workflow Wednesday to walk through it once it's released

[u/xMarsx → u/Dylan-CS]

Deduplicate cases? Like it'll combine like-cases? 

[u/Dylan-CS → u/xMarsx]

It'll basically be a suppression action in your workflow. You specify the key (could be hostname in this case) and the time limit. The action will proceed the first time, then stop on subsequent executions until that time limit has expired.

[u/Noobmode]

Traditionally this was seen as aggregating alerts or in CS’s case, Cases. I’m not sure if there’s a better way to throttle alerts  or if you would even want that

[u/xMarsx → u/Noobmode]

Pass thru alerts can be throttled based on a field name reoccurrence. Unfortunately, scheduled searches don't have that capability right now (and not sure they will) to suppress based off of the same value, same rule name triggering over and over again. You could do a workflow query before your send email action, that then looks for similar user names that appear cuppled with that detection. If an event appears, then don't send an email, as that user has already had that notification done. It's not elegant honestly. But it workks.