I just turned on the connector for corelight ndr investigator on NGSIEM I am seeing the corelight alert log in the advance search but they are not populating in MGSIEM detections. Will I have to create the rules from rules templates?

Quick PSA for anyone interested in participating in the CrowdStrike AgentWorks Hackathon: submissions close October 20, 2026!

If you've been experimenting with AgentWorks or have an idea for an AI agent that could help solve a real security operations challenge, now's your chance to submit it.

No coding required, and you can participate individually or as a team. Multiple submissions are welcome.

For more details on getting started, building, testing, and submitting your agent, check out the original hackathon post.

Register and submit your agent here.

Hi everyone,

Is there a way to create a workflow in CrowdStrike Falcon that automatically deletes files after they have been quarantined?

I’m looking for a solution where, once a file is moved to quarantine, Falcon can automatically remove it rather than requiring manual cleanup.

Has anyone implemented something like this using Falcon Fusion workflows or another Falcon capability?

Does anyone know how to setup Falcon MCP in Copilot studio. I am having to switch over from claude to copilot and would like some assistance since copilot is new to me.

This has to be the longest I've waited for an agent update between releases for a while and we're close a second point release for 26.04.

Last commit was over a year ago.

https://github.com/CrowdStrike/psfalcon

Is there a way to scan specific host groups in the exposure management network scanning feature?

Wondering if anyone else is seeing this.
We opened a ticket with our Falcon Complete team. But I'm curious if this is a sensor issue and if anyone is seeing a large number of these alerts.

An attack seems unlikely in our scenario as we have disjointed networks protected under the same CS Falcon tenant and we're seeing his from multiple environments.

What does everyone do to handle duplicate hosts? What are best practices when someone installs a sensor and then wipes and installs again creating a duplicate host in the host management.

Hi All

Im trying to write a query that will show the time difference between when a log is ingested and when a rule has triggered. Ive been looking through docs but could do with some help on which repos or events I should be looking at.

So far ive been experimenting with the detections and xdr_indicatorsrepo repos, but Im not sure this is correct?

Are detections logged in a way that they can be queried? Which time fields should I be using to compare the detections to the raw log?

Thanks

I want to look through and see devices that have had no USB mass storage devices connected over the last X amount of days. Is this possible or easy to query? The idea is to see who I have allowed to use USB devices and if they are not using them (not an actual business need).

Hello Team,

I am new to soc team. I recently joined an organization as soc analyst. I am facing issue while investigating crowdstrike alerts. Can anyone pls tell me how to investigate Custom IOC DOMAIN/Ip critical alerts in crowdstrike falcon.

We manage a large Windows fleet using Falcon Spotlight for vulnerability management and ManageEngine for patching. Our current manual process for high-priority vulnerabilities:

1. Receive a Jira ticket with a CrowdStrike CSV (affected devices, software, version, KB/remediation).
2. Run a script via ManageEngine to verify the vulnerable software and check if the patch/superseding patch is missing. (Because I find that Falcon loves false positives)
3. Filter down to confirmed affected endpoints.
4. Manually configure and deploy the patch.

My questions are: How are other teams automating the pipeline between CrowdStrike Spotlight findings and ManageEngine deployment? Is manual pre-verification necessary, or can/should ManageEngine handle patch detection and supersedence natively via automated patch policies?What industry best practices or integrations would streamline this workflow?

We did a POV with AIDR before fal.con and thought it was beta at very best. Now a few months have past a rename happened and my salesdude is trying to sell me it for 140k all in.

Unfortunately, I don't know of any competitors to it but man I hate to get it at that price with what we saw in August.

Can I get some thoughts on what you do, if you have it and how it is now. Competitors? RSA is so far away but I may just bury my head in the sand and build requirements until I can shop at RSA in the spring. 🤷‍♂️

As the title suggests, I'm looking for some guidance on configuring a Fusion Workflow to trigger upon an NGSIEM Detection that contains a particular detection name, which then feeds the username that triggered the detection into the SOAR function to revoke Entra session tokens (and maybe even the function to disable accounts or reset passwords). After a successful or failed completion, it would update the detection with that note and send an email to the team.