I have to take the CCFA exam before Sept 2nd. I have studied CrowdStrike documentation, exam guide, practice test, and CS University. I do want to practice exam questions.
I saw online a couple of practice exam tests - Udemy, VMexam, and Pass4exam. Any advice on which one to buy? Do you recommend it?
Looking for any additional tips, tricks, or resources anyone can recommend. Ty in advance.
Hey Guys,
We are looking to automate device hygiene reporting (specifically BitLocker and Secure Boot status) into a Power BI dashboard for our IT operations. Since these posture metrics are covered under our Exposure Management licensing, is there a native way to build a custom asset inventory report and schedule automated exports on a recurring cadence? Any guidance or recommended approach for pulling this data into Power BI would be appreciated.
Thanks for the help in advance
Wanted to know real use cases you guys are solving using CS runtime security for containers.
Since we are already allowing only Known outbound traffic from firewall, this significantly reduces possibility of c2 connection.. Do we still need runtime security? It yes appreciate for real value use cases it can solve please…
Hi guys,
Wondering if any aussies have managed to successfully implement the "Microsoft Office is blocked from creating child processes" E8 control with CrowdStrike?
We've tested using a custom IOA but it's not managable, way too much noise.
Would love to know how E8 compliant shops with CrowdStrike are acheiving this control.
Welcome back to Workflow Wednesday!
If you’ve ever had a single noisy alert turn into endless workflow executions, email notifications, and duplicate cases, this one’s for you.
The new Deduplicate action gives Fusion workflows a simple way to recognize when they’ve already handled the same activity and decide what should happen next - instead of repeating the same work over and over again.
We're just scratching the surface of what you can do with this. You can throttle noisy detection sources, suppress repeat notifications, avoid rerunning expensive enrichment, prevent duplicate remediation actions, or make sure only one workflow execution performs a shared task while the others reuse its result.
At its core, Deduplicate answers one question: Have I already handled this combination of values within this period?
You define that combination by building a key from one or more fields, choose whether the key is scoped to a single workflow or shared across the CID, and set how long the entry should remain active. From there, Fusion handles the coordination.
Imagine the same phishing campaign targets 25 users. Each email generates a separate detection, but they all share the same detection name, sender, and subject.
Without deduplication, our workflow could create 25 separate cases for what is really one phishing campaign. With deduplication, we can turn that into: 25 phishing detections → 1 case containing all 25 detections
Here’s how.
We’ll start by creating a workflow with the following trigger:
Detection → NG-SIEM Third Party Detection
Since we don’t want every third-party detection entering this workflow, we’ll add a condition immediately after the trigger to narrow things down to the phishing detections we care about.
For this example, we’ll use:
This gives us a clean starting point: only the Mimecast phishing detections we want to correlate will continue through the workflow.
From here, we can start deciding whether each detection represents a new phishing campaign or one we’re already tracking.
Next, we need to decide what makes two detections part of the same activity.
For this example, we’ll combine three fields: Detection Name + Sender + Subject
One important detail: Deduplicate keys can only contain letters, numbers, underscores, and hyphens. That means we can’t pass values like email addresses or subjects directly into the Key field. Instead, use the cs.hash.sha1 Data Transformation function to hash the fields into a valid deduplication key.
In the Key field, we’ll use:
${cs.hash.sha1(data['GetDetectionDetails.name'] + "|" + data['GetDetectionDetails.raw_response'].header_from + "|" + data['GetDetectionDetails.raw_response'].subject)}
Depending on the fields you want to include, you may need to add a Get detection details action first. That’s what I’m doing here so we can pull the sender and subject into the workflow.
Now, any detection with the same detection name, sender, and subject will generate the same hash and resolve to the same deduplication entry for the period we configure.
Next, we configure how broadly the deduplication entry should apply.
The Deduplicate action supports two scopes:
For this example, we’ll use workflow scope, since we only want executions of this phishing workflow to share the entry.
We also need to specify the period in seconds. We’ll use 86400, which gives us a 24-hour deduplication window.
After Deduplicate runs, it tells us whether the key already exists.
We’ll add a condition: If Duplicate is equal to False
That gives us two paths:
Only the first matching detection follows the TRUE path and performs the primary work.
If Duplicate = False, we know this is the first detection associated with this key. Even if several detections with the same key arrive at the exact same time, only one execution can claim the deduplication entry and follow this path.
On the TRUE path, we’ll:
For the case name, we can use the sender and subject to make it immediately recognizable:
Phishing Campaign - ${data['GetDetectionDetails.raw_response'].header_from} - ${data['GetDetectionDetails.raw_response'].subject}
Next, add Set Deduplicate Entry Metadata.
Use the same key we created earlier, then set the Metadata field to the Case ID returned by Create a new Case: ${data['CreateANewCase.id']}
This is the important part: we’re attaching the Case ID to the deduplication entry so every duplicate execution knows which case it belongs to.
Now for the ELSE path.
If an execution lands here, Fusion already has an active deduplication entry for that combination of detection name, sender, and subject.
First, add Wait for Deduplicate Entry Metadata and use the same key again.
Why add the wait action? A duplicate detection could arrive milliseconds after the first one - before the original workflow execution has finished creating the case and storing its case ID.
Wait for Deduplicate Entry Metadata handles that timing problem for us. It waits for the original execution to populate the metadata and returns as soon as that value is available.
Once we have the Case ID, we'll use the Add detections to case action.
Set the Case ID to the metadata returned by the previous action: ${data['WaitForDeduplicateEntryMetadata.metadata']}
Then add the current Detection ID to that case.
Note: For the Case ID field, you’ll need to switch to the Text input option and paste the expression above.
Let's now test our workflow. Here's the first execution for a given key:
Subsequent execution(s) using the same key:
Instead of creating a new case every time the same phishing campaign generates another detection, each matching detection now gets added back to the case created by the first execution.
The release includes six new actions:
These actions give Fusion workflows a native way to suppress duplicate processing, reduce case sprawl, throttle noisy activity, reuse work across executions, and coordinate workflows around shared state.
And a fun detail before I wrap this up:
After writing this post, I asked Claude Code to build the same workflow using the newly released Fusion Skills. It did pretty well!
That deserves its own post, so we’ll dig into how it works in an upcoming Workflow Wednesday.
That’s it for this week!
Hi All
Im having an odd issue and hoping someone might have a solution. Ive onboarded esxi host syslog via logscale, however the data connector is idle and we are not seeing any logs.
We are using custom ports which have been specified in the configuration, and opened on the firewall. The configuration also has cisco syslog which is coming through fine to the same collector.
Ive tried creating separate configurations, rebuilt the data connector multiple times, tried using the generic hec connector, used wireshark to confirm the logs are being sent from the esxi host to the log collector on the correct port, disabled any firewalls between hosts and confirmed outbound connectivity over 443 to the CS console.
As far as I can see, the network connectivity is fine, given then other log sources are all active.
Any thoughts / suggestions / help would be appreciated as it driving me nuts!
Hi there, thanks for reading!
i am trying to bring together two of our logs NGSIEM.
Falcon logs to see which user was logged into a client at a given time
Our firewall logs that only show source and destination ip but no user.
Here is my try:
defineTable(query={
UserName!="*$" and UserName!=""
|cidr("LocalIP", subnet=["MYlocalSubnets"])
}, include=[aid,UserName, LocalIP], name="Computers")
| u/collect.host="CollectingHostOfFirewallLogs"
| cidr("source.ip", subnet=["RelevantSubnets")
| in(field="destination.port", values=[Ports i am looking for])
| match(file="Computers", field=[LocalIP])
|groupBy([source.ip, destination.ip,destination.port, Vendor.rule, UserName])
|sort(destination.ip)
But the bigger my search window is, the worse by result gets as the Computers table will be static only and not having any time component in it.
Is there a way to get around this?
Thank you!
I am finding very little information on the new V2 browser extension. If we just have Falcon GO is there any benefit in deploying browser extension?
Hi all,
I'm fairly new to this. We've been deploying crowdstrike on all the hosts in the company because the main branch asked us to. We had CID, token, had to jump through some loops for some devices but we managed to get it done. However, we've started to face an issue. As we're facing the end of our current AV license to be replaced by crowdstrike, we want to rest assured that cs is on all the hosts. We only have read-only access to the dashboards and some hosts that have been inactive for more than 30 days just disappear from the dashboard.
Is there a way to confirm, at this point, that a host, not appearing on the main dashboard, has got the sensor?
It's very hard to keep track since some laptops that may already be equipped with the sensor, may have been rotting in a locked drawer for a while.
Thank you so much in advance :)
Edit: For those who might come by looking for answers, I found a solution : I took the previous reports from Excel that we had since the beginning of the deployment, put them in a folder. Then I wrote a powershell script to navigate the name column and stop when it matches the device’s name you were looking for. Now we know which host disappeared but has crowdstrike on it (it was just turned off for too long stuck in a drawer or something), and which host never got crowdstrike in the first place. You have to get creative when you don’t have intune lol. If it helps even one person navigate the same situation, this post is a success.
Relatively new to CS and trying to get my hands on NG-SIEM. For those that have taken the instructor lead courses (the 8 hour ones), which courses were actually useful? My experience I'd say is between CCFA and CCSE certification
I've had roughly 3-6 months on the platform, but went on a hiatus to take care of some other things. I just feel like there is never ending modules in this platform...lol
link to courses: https://www.crowdstrike.com/en-us/crowdstrike-university/training-calendar/
Hello,
I am looking for a way to create a CrowdStrike SOAR playbook to email us whenever a Critical or High EXPRT vulnerability surfaces. Right now, we use Tines to do this for us, but no that it has been a few years since we have revisited this, is it possible?
Thank you!