EDR Operational Repository

Sensor Installation & Provisioning (CrowdStrike Falcon)

Standard installation procedure for enterprise endpoints across OS platforms.

Windows: WindowsSensor.exe /install /quiet /norestart CID=YOUR_CUSTOMER_ID_HERE

• Download host installer from Falcon Console via Host Management > Sensor Downloads.
• Execute silent installation using the assigned CID (Customer ID) parameter.
• Verify live agent heartbeat in the Falcon Console host dashboard.

Troubleshoot Offline / Reduced Functionality Sensors

Steps to restore communications and resolve sensor connectivity status issues.

• Check local service status (CSAgent service on Windows endpoints).
• Verify network connectivity to CrowdStrike cloud endpoints over TCP port 443.
• Review proxy configuration and SSL inspection exclusions.

Prevention Policy Configuration & Exclusions

Tuning prevention policies to suppress false positives while maintaining threat coverage.

• Create host groups for targeted policy assignment and phased enforcement.
• Configure Machine Learning and Behavioral Isolation thresholds based on risk profile.
• Add strict hash or path exclusions only after thorough threat verification.

Process Execution Hunting (CQL)

Querying execution events across Windows, Linux, and macOS endpoints.

#event_simple_name=ProcessRollup2 ImageFileName=/*powershell.exe/i 
| select([@timestamp, ComputerName, UserName, CommandLine, ParentBaseFileName])

• #event_simple_name=ProcessRollup2: Filters for raw process creation telemetry.
• /i: Case-insensitive regex match on binary names.
• select(...): Trims output fields for rapid analyst triage.

Network Activity & Lateral Movement Hunting (CQL)

Detecting unusual outbound connections and network behavior across hosts.

#event_simple_name=NetworkConnectIP4 RemoteAddressIP4=* 
| groupby(RemoteAddressIP4, function=count()) 
| sort(cnt, order=desc)

• #event_simple_name=NetworkConnectIP4: Captures IPv4 connection events.
• groupby(..., function=count()): Aggregates total connection counts per destination.
• sort(cnt, order=desc): Orders destination IPs to highlight anomaly spikes.

USB Device Control Policy Enforcement

Managing removable storage access across enterprise assets.

• Define Device Control policies to block or restrict mass storage devices.
• Configure granular exceptions based on Vendor IDs, Product IDs, or specific Serial Numbers.

Grant Permissions for RTR Active Remediation

Configuring Role-Based Access Control (RBAC) scopes for active incident response.

• Use Roles & Permissions to assign RTR roles (Read Only vs Active vs Admin).
• Scope permissions appropriately using host groups and access management boundaries.

Essential RTR Command Reference

Common administrative terminal commands executed during active investigation sessions.

• ls: List directory contents on remote host.
• get <path>: Download file asset from target machine to analyst workstation.
• kill <pid>: Terminate executing process by PID.

Upload Scripts to RTR Script Repository

Staging remediation and triage scripts for enterprise-wide RTR execution.

• Navigate to console Script Repository (requires RTR Admin privileges).
• Upload target scripts (PowerShell / Bash / Python) and execute in active sessions via runscript.

Troubleshoot "Access Denied" or RTR Session Timeouts

Resolving session initialization blocks during response operations.

• Confirm user role includes required RTR permission tier (Active / Admin).
• Verify host is online and actively checking into the cloud control plane.
• Ensure network/proxy filters are not blocking RTR traffic channels.

Pull Memory Dumps / Forensics from Isolated Machines

Collecting forensic artifacts from assets placed under network containment.

• Contain machine; verify required management paths remain reachable.
• Prefer targeted artifact collection over full memory dumps where bandwidth is limited.
• Compress and encrypt payload files before exfiltrating via RTR session commands.

OAuth2 API Client Setup with Least Privilege

Configuring secure API credentials for external tools and automation platforms.

• Create an API client within the Falcon Console API keys menu.
• Grant strictly required API scopes (e.g., Read-Only for Host Management).
• Restrict client access using Access Scopes where available.

SIEM Integrations - Splunk / Sentinel / Elastic / QRadar

Forwarding detection alerts and raw event streams to external SIEM platforms.

• Typical integration choices: Event Streams API vs Falcon Data Replicator (FDR).
• Select data pipelines based on event volume, retention requirements, and schema design.

Event Streams API vs. Falcon Data Replicator (FDR)

Differentiating real-time alert streams from bulk raw telemetry replication.

• Event Streams API: Streaming, near-real-time event and alert delivery via REST APIs.
• Falcon Data Replicator (FDR): Bulk delivery of comprehensive raw endpoint telemetry to cloud storage (AWS S3) for long-term analytics.

SSO / SAML + MFA Setup

Enforcing identity authentication standards for console access.

• Configure Single Sign-On (SSO) in console parameters and enforce MFA requirements.
• Implement strict RBAC controls to separate tier-1 operators from administrators.

RBAC Tiering - Tier-1 vs Tier-3 Analysts

Establishing operational boundaries between triage and engineering teams.

• Tier-1: Read-only access + triage capabilities, restricted or no RTR, no policy editing rights.
• Tier-3: Engineering and admin access, policy tuning, active RTR remediation, and system config access.

Automated Email / Slack / Teams Alerts

Routing critical alerts directly to SOC communication tools.

• Leverage Falcon Fusion Workflows and notification plugins to route high-severity detections automatically.

Track Audit Logs

Auditing administrative changes, token generations, and policy edits.

• Navigate to Audit Logs in the Falcon Console.
• Filter events by action type (e.g., policy edits, token retrievals, role modifications).