psfalcon VS rtr

Rather than using flight control, you could consider doing a import/export of your configuration, then mass uninstall and reinstall each individual existing CID into your new single CID. The parent would really only help with policy inheritence/detection rollup/rbac which you would no longer need after converting to a single instance.

Try using PSFalcon and Get-FalconDetection to see what's in a detection record.

Add-FalconSensorTag Get-FalconSensorTag Remove-FalconSensorTag

There's an example of required fields under the New-FalconIoaRule wiki page, along with the values for disposition_id.

https://github.com/CrowdStrike/falconpy/tree/main/samples https://github.com/CrowdStrike/psfalcon/tree/master/samples

Check out Get-FalconQueue. It goes through a few steps:

Could you open an issue and include a PowerShell transcript with $VerbosePreference = 'Continue'?

Login history is available using Get-FalconHost. You’ll need an RTR script to query the existing user accounts: https://github.com/bk-cs/rtr/tree/main/list_local_user

The only thing I've done as a user is the send_message script, and it's not ideal due to the limited amount of time it displays on the screen.

And here's an RTR script that will run an exe as a secondary process: https://github.com/bk-cs/rtr/tree/main/run_cli_tool

The output of your script needs to be in Json format and the output schema defines what the fields are (along with the format of those fields). You can find PowerShell examples here: https://github.com/bk-cs/rtr

My run_cli_tool script uses Start-Process with PassThru to run an executable and avoid the timeout.

I created this a while ago: https://github.com/bk-cs/rtr/tree/main/send_message

In BK’s personal GitHub repo, he has an artisanal collection of scripts that can be used with RTR. For this example, we’re going to use this one to enumerate Chrome and Edge extensions. If you’re looking at the script, you’ll notice that right at the top is this line:

I made a workflow-friendly version of this, too: https://github.com/bk-cs/rtr/tree/main/list_browser_extension

You can also log the results of Real-time Response scripts themselves to Humio, like I did in my example library.