u/Im_Pooping_RN_

https://preview.redd.it/jlqb85mimeth1.png?width=1008&format=png&auto=webp&s=2ed0d50a6bc171346bffaea4044bd8ddf5b9d793

https://preview.redd.it/a1ylp3gszboh1.jpg?width=623&format=pjpg&auto=webp&s=c4760652d6441c5423f13b15c486bb87d9d17bf9

Srpska propagandna mašinerija često postavlja pitanje šta se dešavalo prije genocida u Srebrenici. Odgovor na to daje Međunarodni krivični sud za bivšu Jugoslaviju (MKSJ).

U nastavku je kompletan odlomak iz zvaničnog prijevoda prvostepene presude Naseru Oriću (paragrafi 100. i 101.):

"Između aprila 1992. i marta 1993. godine, Srebrenica i sela na području pod kontrolom bosanskih muslimana bili su konstantno izloženi srpskim vojnim napadima, uključujući artiljerijske napade, snajpersku vatru i povremeno bombardovanje iz zraka. Svaki napad se odvijao po sličnom obrascu. Srpski vojnici i paravojne jedinice okružili bi selo sa bosanskim muslimanima, pozvali stanovništvo da preda oružje, a zatim započeli sa nasumičnim granatiranjem i pucanjem. Zatim bi ušli u selo, protjerali ili ubili stanovništvo, koje nije pružalo značajniji otpor, i uništili njihove domove. Srebrenica je svakodnevno bila izložena nasumičnom granatiranju iz svih pravaca. Potočari su posebno bili svakodnevna meta jer su bili osjetljiva tačka u liniji odbrane oko Srebrenice. Druga bosansko-muslimanska naselja bila su redovno napadana. Sve je to rezultiralo velikim brojem izbjeglica i žrtava."

I'm trying to alert on USB activity for endpoints with hostnames starting with servers*.

Right now I have a scheduled workflow that runs every 30 minutes, executes the query below, and sends an email if any results are found:

#event_simpleName=/(UsbDeviceBlocked|UsbDeviceAllowed)/

| join(

{

#event_simpleName=UserLogon

| groupBy([ComputerName], function=selectLast(UserName))

},

field=ComputerName,

include=[UserName]

)

| UserName := replace(field=UserName, regex=".*\\$$", with="/")

| EventTime := formatTime("%Y-%m-%d %H:%M:%S", field=@timestamp)

| EventType := #event_simpleName

| select([EventTime, ComputerName, UserName, EventType])

It works, but it feels like a workaround rather than the right solution.

My goal is to know:

• Which server had USB activity
• Which user was involved
• Ideally whether files were copied to or from the USB device
• Get alerted as close to real time as possible

How are you handling this in Falcon? Is there a better approach than a scheduled workflow, such as detections, workflows, RTR, custom IOAs, or something else?

Any suggestions are appreciated. Thanks! 👍

Hey everyone,

I’m a bit confused about CrowdStrike sensor installation and can’t seem to find a clear answer in the docs.

When installing the sensor on a Windows machine, can you do it using only an installation token, or do you still need the CID as well?

For example, is this enough:

WindowsSensor.exe /install /quiet /norestart ProvToken=YOUR_TOKEN

Or do you actually need both CID and token, like:

WindowsSensor.exe /install /quiet /norestart CID=XXXX ProvToken=YOUR_TOKEN

Google seems to say one thing, AI tools another, and I’m not finding a definitive answer in official documentation.

Would really appreciate clarification from someone who has actually tested this or works with Falcon regularly.

Thanks!

Vec mjesec dana stalno ispred Jevrejskog centra u Banja Luci je kombi parkiran i policija u njemu. Zbog cega?

Znaci i RS-om vladaju?

https://preview.redd.it/dus4z7lfpdxg1.png?width=940&format=png&auto=webp&s=85e6f94b059945c3254f306dd64a54fa6fa33809