Please enable JavaScript.

Coggle requires JavaScript to display documents.

FALCON ADMINISTRATOR - Coggle Diagram

- - - - Update Throttling
        
        limit amount of hosts updated in the same time (network bandwidth)
        Support and Resources -> General Settings
    - - If sensor is unable to esablish network commiunication, it will try again in 10 minutes. If fails again, it will uninstall itself
    - - Uninstall protection options
        
        Move host to protection group with "Sensor protection" set to "Uninstall and maintenance protection"= disabled
        
        Sensor is offline and "Uninstall and maintenance protection" is enabled. You needd to get individual token for host via "Reveal maintenance token" in Actions. Then
        CsUninstallTool.exe MAINTENANCE_TOKEN=<token> /quiet
        
        Sensor is offline and bulk maintenance mode is enabled
        Go to the host's sensor update policy and click Reveal Token to get the bulk maintenance token, then:
        CsUninstallTool.exe MAINTENANCE_TOKEN=<token> /quiet
  - - - Paused updates (not recommended) and it's risks
        
        Sensor Operations channel paused -> sensors won't receive sensor configuration updates, impact OSes and application compatibility and may lead to (RFM) Windows / Linux.
        
        Rapid Response - Allowlisting and Blocklisting pased -> sensors won’t receive allowlisting and blocklisting updates generated by CrowdStrike threat researchers and analysts.
        
        Vulnerability Management paused -> sensors won’t receive updated vulnerability definitions and data.
        
        System Critical channel CANNOT BE PAUSED
- - - - Rule Types:
        
        process creation
        
        file creation
        
        network connection
        
        domain name
        
        URL
        
        cmdline argument
      - Steps to create
        1) create a rule group
        2) add your IOAs (custom rules) to the rule group
        3) enable your rules
        4) enable your IOA rule group
        5) Assign group to a prevention policy
        6) add prevention policy to a host group
      - Regexp
        
        .* wildcards
        
        need to scape \ just like usual
        
        leave all unused fields as .*
        
        always TEST before implementing
      - What we can do with IOAs:
        
        block CIDR of IPs
        
        block domains
        
        file names
        
        file paths
        
        parent, grandparent file names /process (like Powershell)
        
        command line arguments
      - Actions:
        
        monitor
        
        detect
        
        block execution
        
        kill process
  - - - Custom IOAs rules - are for BLOCKING ONLY
        don't be confused!
      - Custom IOA is different than IOS Rule Groups
    - - How to add ML Exclusion
        Go to Endpoint section -> Exclusions -> ML Exclusions -> All Hosts -> Next (paste exclusion pattern, click 'detection and preventions check box', click create
      - GLOB patterns
        
        \*\ - for 1 folder
        
        \**\ - for recursive
        
        limit 1 pattern per exclusion
        
        example for Malwarebytes:
        *\Program Files\Malwarebytes*
- - - - Assign to HG via Assigned Host Groups within policy (one or more HGs)
        
        Prevention policy and Sensor Update Policy can be applied only to a single HG. When added, are no longer visible to be added
      - Precedence:
        Lower number has higher priority (on the top is most important)