EDR Telemetry & Operations

Troubleshoot High CPU/RAM from csagent / falcon-sensor (CrowdStrike Falcon)

System resources spiking excessively due to EDR kernel drivers or scanning activity.

Resolution Runbook:

• Confirm if it’s sustained vs. a short spike (post-boot, post-update, heavy I/O periods).
• Check for third‑party AV/EDR conflicts and ensure mutual exclusions where required.
• Validate sensor/OS are on supported versions.
• Collect diagnostics and open a case if persistent (performance troubleshooting is OS/workload-specific).

Diagnostic Logs Collection for Support (CrowdStrike Falcon - Win/Linux/macOS)

Standardized diagnostic bundle generation commands across target operating systems.

Resolution Runbook:

• Windows: Collect using CSDiagnostics.exe and/or cswindiag package.
• Linux: Collect falcon-diagnose output (plus relevant system logs/journal).
• macOS: Generate sensor diagnostics bundle (as directed by Support).
• Note: Collect as close as possible to the issue timeframe (right after a crash, high CPU, or RFM event).

Verify Active Communication with Cloud Control Plane (CrowdStrike Falcon)

Ensuring an endpoint maintains continuous telemetry pipelines with the cloud environment.

Resolution Runbook:

• Console-side: Confirm Host status = Online and "Last seen" advances on refresh.
• Host-side: Confirm service is running and validate egress/proxy settings.
• If available, use RTR (Real-Time Response) to execute service and network validation checks.

Sensor Install Failures on Linux Distributions / Kernels (CrowdStrike Falcon)

Failures associated with unsupported kernel versions or missing build toolchains.

Resolution Runbook:

• Distro/kernel combination may be unsupported, or the kernel is missing required features.
• Kernel headers/toolchain prerequisites may be missing (varies by distro).
• Align system build to a supported distro + kernel combo and verify Linux install prerequisites.

Sensor Service Fails to Start or Continuously Crashes (CrowdStrike Falcon)

Addressing continuous daemon crashes or service initialization blocks.

Resolution Runbook:

• Review OS event logs (Windows Service Control Manager / Linux journal) around failure events.
• Check for incomplete upgrades, remnants, missing files, or security software blocking drivers/binaries.
• Repair or reinstall per platform guidance and revalidate cloud communication channels.

Verify Proxy Settings on Agent Using falconctl (CrowdStrike Falcon)

Checking agent proxy parameters using local terminal flags.

# Typical (Linux) checks - Show current configuration:
falconctl -g --proxy-host --proxy-port --proxy-user --proxy-pwd --cid

# Confirm the proxy is reachable and allows outbound HTTPS to CrowdStrike endpoints.

Issue: Installation Failing with "Invalid Customer ID (CID)" (CrowdStrike Falcon)

Checksum or format mismatches during deployment onboarding.

Resolution Runbook:

• CID is mistyped or the checksum/format expected by that installer package isn't met.
• Wrong CID specified for the target tenant or cloud region.
• Re-copy CID from the console and re-run install; confirm tenant/region compatibility.

Fix Duplicate Agent IDs After Cloning / Imaging VM Templates (CrowdStrike Falcon)

Preventing agent identity collisions when deploying cloned master virtual machines.

Resolution Runbook:

• Occurs when a "gold image" is cloned after the sensor has already generated its unique identity.
• Follow golden-image/VDI guidance: generalize/clean sensor identity prior to sealing the template.
• Allow newly cloned machines to generate a fresh identity on first boot.

Generate an Uninstall / Maintenance Token (CrowdStrike Falcon)

Bypassing local tamper protection controls for maintenance or removal operations.

Resolution Runbook:

• In the Falcon console, retrieve the maintenance token from Host Management for the specific host.
• Alternatively, leverage bulk maintenance mode where enabled.
• Token input is required whenever uninstall/maintenance protection is enforced.

Detect vs. Prevent Policy Settings & Safe Rollout (CrowdStrike Falcon)

Phased strategy for deploying security posture policies without business disruption.

Resolution Runbook:

• Detect Mode: Generates detections/telemetry without blocking execution.
• Prevent Mode: Enforces real-time blocking, file quarantine, and process termination actions.
• Safe Rollout: Start in Detect for a pilot group → tune exclusions/allowlists → expand rollout → move to Prevent in stages.

IOA Exclusion vs ML Exclusion (CrowdStrike Falcon)

Differentiating behavioral suppression from hash-based allowlisting rules.

• IOA Exclusion: Suppresses behavior/indicator-of-attack style detections (process, command-line, ancestry scoped with regex).
• ML Exclusion / Hash Allowlist: Suppresses file-based ML detections by file hash and/or trusted application allowlists.

Allowlist / Hash-Exception a Trusted Internal App (CrowdStrike Falcon)

Creating exclusions for proprietary software triggering false positives.

Resolution Runbook:

• Use IOC/Allowlisting by SHA256 hash and scope appropriately.
• Prefer vendor-signed binary path + signer controls when available over broad path exclusions.

Quarantine / Un-quarantine False Positives (CrowdStrike Falcon)

Restoring blocked legitimate applications and adjusting policies.

Resolution Runbook:

• Quarantine behavior is policy-driven; view and manage quarantined items in the console.
• Restore/un-quarantine the item (if permitted by policy).
• Add the correct exception (IOA vs ML/hash) so the alert does not recur.

Network Isolation / Containment Procedures (CrowdStrike Falcon)

Isolating compromised assets while preserving management channels.

Resolution Runbook:

• Containment isolates the host to limit network traffic.
• Allowed traffic typically permits required Falcon communications and explicitly allowed management traffic.
• Trigger via: Host Actions → Contain Host (requires elevated console permissions).

Best Practices for Grouping Tags (CrowdStrike Falcon)

Structuring dynamic host groups for automated policy targeting.

• Use consistent naming conventions and tags to dynamically place hosts into host groups.
• Avoid one-off tags; structure tags around role/environment/location patterns (e.g., Env/Prod, Role/Web).

Prevent EDR from Scanning Specific Folders / Databases (CrowdStrike Falcon)

Optimizing high-I/O directories to prevent performance degradation.

Resolution Runbook:

• Use prevention policy exclusions sparingly.
• Follow vendor-recommended paths and keep scope tightly constrained to specific processes/paths.
• Follow updated Windows file path exclusion guidance for heavy build workloads.

USB / Device Control Policies Setup (CrowdStrike Falcon)

Managing removable media access and hardware blocking rules.

Resolution Runbook:

• Create a Device Control Policy → set block/allow rules by device class and identifiers.
• Assign policy to host groups → launch in audit/monitor mode → transition to active enforcement.

Recommended Sensor Update Deployment Strategy (CrowdStrike Falcon)

Minimizing enterprise risk during sensor version upgrades.

• Use Sensor Update Policies with staged rollout rings (Pilot → Broad → Critical).
• Leverage built-in throttling controls to avoid network bandwidth spikes.
• Monitor health, last-seen timestamps, and detections during rollouts while keeping a rollback plan ready.

ProcessRollup2 vs SyntheticProcessRollup2 vs CommandHistory (CrowdStrike Falcon)

Understanding event schema classification in endpoint event telemetry.

• ProcessRollup2: Primary process execution telemetry for processes observed while the sensor is active.
• SyntheticProcessRollup2: "Catch-up" process telemetry for processes already running when the sensor starts.
• CommandHistory: Interactive shell/terminal command history captured during an active session.

Encoded PowerShell Executions - Decode Base64 (CrowdStrike LogScale CQL)

Extracts base64 payload strings executed via PowerShell and decodes UTF-16LE characters.

#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/\\powershell(_ise)?\.exe/i
| CommandLine=/\s-[e^]{1,2}[ncodema^]+\s(?\S+)/i
| decodedCommand:=base64Decode(base64String, charset="UTF-16LE")
| table([ComputerName, UserName, CommandLine, decodedCommand, @timestamp])

Network Connections to Specific External IP (CrowdStrike LogScale CQL)

Tracks endpoint network events targeted toward specific external destinations.

#event_simpleName=NetworkConnectIP4
| RemoteAddressIP4="192.0.2.100"
| table([@timestamp, ComputerName, UserName, LocalAddressIP4, LocalPort, RemoteAddressIP4, RemotePort, Protocol])
| sort(@timestamp, order=desc)

Executions from Temp Directories - Windows (CrowdStrike LogScale CQL)

Detects binaries launching out of temporary system or user directories.

#event_simpleName=ProcessRollup2 event_platform=Win
| (ImageFileName=/\\AppData\\Local\\Temp\\/i OR ImageFileName=/\\Windows\\Temp\\/i)
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentImageFileName])
| sort(@timestamp, order=desc)

Scheduled Task Creation / Changes - Windows (CrowdStrike LogScale CQL)

Monitors persistence setups established via Windows scheduled task modifications.

in(field=#event_simpleName, values=[ScheduledTaskRegistered, ScheduledTaskModified])
| table([@timestamp, ComputerName, UserName, TaskName, TaskPath, CommandLine])
| sort(@timestamp, order=desc)

Service Creation - Windows (CrowdStrike LogScale CQL)

Surfaces service creation attempts initiated via sc.exe or PowerShell cmdlets.

#event_simpleName=ProcessRollup2 event_platform=Win
| (CommandLine=/\bsc\.exe\s+create\b/i OR CommandLine=/\bNew-Service\b/i)
| table([@timestamp, ComputerName, UserName, CommandLine, ParentImageFileName])
| sort(@timestamp, order=desc)

Unauthorized User Creation / Local Privilege Escalation (CrowdStrike LogScale CQL)

Audits local account creation and administrator group assignment actions.

#event_simpleName=ProcessRollup2 event_platform=Win
| ImageFileName=/\\net(1)?\.exe$/i
| CommandLine=/\b(user\s+\S+\s+\/add|localgroup\s+administrators\s+\S+\s+\/add)\b/i
| table([@timestamp, ComputerName, UserName, CommandLine, ParentImageFileName])
| sort(@timestamp, order=desc)

Endpoints Not Communicating in 30 Days (CrowdStrike LogScale CQL)

Identifies stale or inactive sensor assets based on heartbeat interval checks.

#event_simpleName=Heartbeat
| groupBy([aid, ComputerName], function=max(@timestamp, as=lastSeen))
| lastSeen < now()-30d
| sort(lastSeen, order=asc)

Shadow Copy Deletion - Ransomware Indicator (CrowdStrike LogScale CQL)

Alerts on command lines targeting vssadmin or wmic to delete volume shadow backups.

#event_simpleName=ProcessRollup2 event_platform=Win
| CommandLine=/\bvssadmin\s+delete\s+shadows\b|\bwmic\s+shadowcopy\s+delete\b/i
| table([@timestamp, ComputerName, UserName, CommandLine, ParentImageFileName])
| sort(@timestamp, order=desc)

Aggregate / Count Unique Process Runs Per Host (CrowdStrike LogScale CQL)

Groups and ranks unique process executions to establish prevalence baselines.

#event_simpleName=ProcessRollup2
| groupBy([ComputerName, UserName, ImageFileName], function=[count(as=runCount), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)])
| sort(runCount, order=desc)

Which URLs/IPs Must Be Allowed? (CrowdStrike Falcon)

Configuring perimeter network firewalls to allow outbound sensor communications.

• Cloud endpoints are tenant-region specific (US-1, US-2, EU-1, US-GOV-1) and published by CrowdStrike.
• Always verify region-specific cloud endpoints and permit outbound HTTPS (443) traffic accordingly.

SSL / TLS Inspection Guidelines (CrowdStrike Falcon)

Managing middlebox inspection and certificate-pinning requirements.

• TLS inspection/decryption breaks sensor certificate pinning channels.
• Bypass SSL/TLS inspection for all destination URLs assigned to CrowdStrike sensor traffic.

Proxy Credentials During Automated Deployment (CrowdStrike Falcon)

Passing proxy authentication parameters during silent sensor installations.

• Windows: Supports passing proxy parameters during MSI installation (e.g., ProxyHost, ProxyPort).
• Linux / macOS: Configure using falconctl post-install or via deployment tooling.

Determine Cloud Region & Endpoint Validation (CrowdStrike Falcon)

Identifying the primary cloud instance assigned to your organization.

• Check your Falcon console URL structure or verify configured cloud endpoints within Sensor Update settings.

Troubleshoot Timeouts over TCP 443 (CrowdStrike Falcon)

Diagnosing egress transport timeouts and broken socket channels.

Resolution Runbook:

• Validate DNS resolution, proxy authentication policies, TLS interception bypasses, and firewall egress rules.
• Confirm middlebox security controls do not terminate long-lived TCP connections.

PAC Files Support (CrowdStrike Falcon)

Configuring Proxy Auto-Configuration script routing on endpoints.

• Supported behaviors vary by host OS and sensor software version.
• Validate local PAC resolution to guarantee resulting proxies allow required egress.

Grant Permissions for RTR Active Remediation (CrowdStrike Falcon)

Configuring Role-Based Access Control (RBAC) scopes for active incident response.

• Use Roles & Permissions to assign RTR roles (Read Only vs Active vs Admin).
• Scope permissions appropriately using host groups and access management scopes.

Essential RTR Command Reference (CrowdStrike Falcon)

Common administrative terminal commands executed during active investigation sessions.

• ls — List directory contents
• get <path> — Download file asset from target machine
• kill <pid> — Terminate executing process by PID

Upload Scripts to RTR Script Repository (CrowdStrike Falcon)

Staging remediation and triage scripts for enterprise-wide RTR execution.

• Navigate to console Script Repository (requires RTR Admin privileges).
• Upload target scripts (PowerShell / Bash / Python) and execute in active sessions via runscript.

Troubleshoot "Access Denied" or RTR Session Timeouts (CrowdStrike Falcon)

Resolving session initialization blocks during response operations.

Resolution Runbook:

• Confirm user role includes required RTR permission tier (Active / Admin).
• Verify host is online and actively checking into the cloud control plane.
• Ensure network/proxy filters are not blocking RTR traffic channels.

Pull Memory Dumps / Forensics from Isolated Machines (CrowdStrike Falcon)

Collecting forensic artifacts from assets placed under network containment.

Resolution Runbook:

• Contain machine; verify required management paths remain reachable.
• Prefer targeted artifact collection over full memory dumps where bandwidth is limited.
• Compress and encrypt payload files before exfiltrating via RTR session commands.

OAuth2 API Client Setup with Least Privilege (CrowdStrike Falcon)

Configuring secure API credentials for external tools and automation platforms.

• Create an API client within the Falcon Console.
• Grant strictly required API scopes (e.g., Read-Only for Host Management).
• Restrict client access using Access Scopes where available.

SIEM Integrations - Splunk / Sentinel / Elastic / QRadar (CrowdStrike Falcon)

Forwarding detection alerts and raw event streams to external SIEMs.

• Typical integration choices: Event Streams API vs Falcon Data Replicator (FDR).
• Select data pipelines based on event volume, retention requirements, and schema design.

Event Streams API vs. Falcon Data Replicator - FDR (CrowdStrike Falcon)

Differentiating real-time alert streams from bulk raw telemetry replication.

• Event Streams API: Streaming, near-real-time event and alert delivery via REST APIs.
• Falcon Data Replicator (FDR): Bulk delivery of comprehensive raw endpoint telemetry to cloud storage (AWS S3) for long-term analytics.

SSO / SAML + MFA Setup (CrowdStrike Falcon)

Enforcing identity authentication standards for console access.

• Configure Single Sign-On (SSO) in console parameters and enforce MFA requirements.
• Implement strict RBAC controls to separate tier-1 operators from administrators.

RBAC Tiering - Tier-1 vs Tier-3 Analysts (CrowdStrike Falcon)

Establishing operational boundaries between triage and engineering teams.

• Tier-1: Read-only access + triage capabilities, restricted or no RTR, no policy editing rights.
• Tier-3: Engineering and admin access, policy tuning, active RTR remediation, and system config access.

Automated Email / Slack / Teams Alerts (CrowdStrike Falcon)

Routing critical alerts directly to SOC communication tools.

• Leverage Falcon Fusion Workflows and notification plugins to route high-severity detections.

Track Audit Logs (CrowdStrike Falcon)

Auditing administrative changes, token generations, and policy edits.

Resolution Runbook:

• Navigate to Audit Logs in the Falcon Console.
• Filter events by action type (e.g., policy edits, token retrievals, role modifications).