Skip to content

Commit 4b51186

Browse files
stefansecstefansec
authored
Add files via upload
1 parent 58e8f89 commit 4b51186

2 files changed

Lines changed: 104 additions & 0 deletions

File tree

‎queries/falcon_sensor_version_drift_monitoring__linux_.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# --- Query Metadata ---
2+
# Human-readable name for the query. Will be displayed as the title.
3+
name: Falcon Sensor Version Drift Monitoring (Linux)
4+
5+
# Description of what the query does and its purpose.
6+
# Using the YAML block scalar `|` allows for multi-line strings.
7+
description: |
8+
Compares CrowdStrike Falcon sensor major/minor versions (x.xx) over time for each host. The query detects version changes, classifies them as upgrades or downgrades, and outputs the timestamp of the change along with the previous and current version values.
9+
10+
# The author or team that created the query.
11+
author: ByteRay GmbH
12+
13+
# The required log sources to run this query successfully in Next-Gen SIEM.
14+
# This will be displayed in the UI to inform the user.
15+
log_sources:
16+
- Endpoint
17+
18+
# The CrowdStrike modules required to run this query.
19+
cs_required_modules:
20+
- Insight
21+
22+
# Tags for filtering and categorization.
23+
# Include relevant techniques, tactics, or platforms.
24+
tags:
25+
- Monitoring
26+
27+
# --- Query Content ---
28+
# The actual CrowdStrike Query Language (CQL) code.
29+
# Using the YAML block scalar `|` allows for multi-line strings.
30+
cql: |
31+
defineTable(query={"#event_simpleName" = OsVersionInfo AgentVersion=*
32+
| groupBy([aid,ComputerName,AgentVersion],function=min("@timestamp"))
33+
}, include=[aid,ComputerName,AgentVersion,_min], name="time")
34+
| defineTable(query={"#event_simpleName" = OsVersionInfo AgentVersion=*
35+
| event_platform=Lin
36+
| groupBy([aid,ComputerName],function=[selectFromMin(@timestamp,include=AgentVersion)])
37+
| rename(field=AgentVersion,as=Old_Version)}, include=[aid,ComputerName,Old_Version], name="old")
38+
| "#event_simpleName" = OsVersionInfo AgentVersion=*
39+
| event_platform=Lin
40+
| groupBy([aid,ComputerName],function=[selectFromMax(@timestamp,include=[AgentVersion])])
41+
| rename(field=AgentVersion,as=Current_Version)
42+
| match(old, field=[aid])
43+
| match(time, field=[aid,Current_Version],column=[aid,AgentVersion])
44+
| Current_Version=/(?<Short_Current_Version>\d+\.\d+)/
45+
| Old_Version=/(?<Short_Old_Version>\d+\.\d+)/
46+
| if(condition=Current_Version==Old_Version, then="No change", else=if(condition= Short_Current_Version<Short_Old_Version, then="Downgrade", else=if(condition= Short_Current_Version>Short_Old_Version, then="Upgrade", else=0)))
47+
| Status := rename(field="_if")
48+
| "Changed at" := if(condition=Current_Version==Old_Version, then="n/a", else=formatTime(format="%Y/%m/%d %H:%M:%S", field=_min, as="Zeitpunkt"))
49+
| "Old Version" := rename("Old_Version")
50+
| "Current Version" := rename("Current_Version")
51+
| table([ComputerName,aid, "Old Version","Current Version",Status,"Changed at"])
52+

‎queries/falcon_sensor_version_drift_monitoring__macos_.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# --- Query Metadata ---
2+
# Human-readable name for the query. Will be displayed as the title.
3+
name: Falcon Sensor Version Drift Monitoring (MacOS)
4+
5+
# Description of what the query does and its purpose.
6+
# Using the YAML block scalar `|` allows for multi-line strings.
7+
description: |
8+
Compares CrowdStrike Falcon sensor major/minor versions (x.xx) over time for each host. The query detects version changes, classifies them as upgrades or downgrades, and outputs the timestamp of the change along with the previous and current version values.
9+
10+
# The author or team that created the query.
11+
author: ByteRay GmbH
12+
13+
# The required log sources to run this query successfully in Next-Gen SIEM.
14+
# This will be displayed in the UI to inform the user.
15+
log_sources:
16+
- Endpoint
17+
18+
# The CrowdStrike modules required to run this query.
19+
cs_required_modules:
20+
- Insight
21+
22+
# Tags for filtering and categorization.
23+
# Include relevant techniques, tactics, or platforms.
24+
tags:
25+
- Monitoring
26+
27+
# --- Query Content ---
28+
# The actual CrowdStrike Query Language (CQL) code.
29+
# Using the YAML block scalar `|` allows for multi-line strings.
30+
cql: |
31+
defineTable(query={"#event_simpleName" = OsVersionInfo AgentVersion=*
32+
| groupBy([aid,ComputerName,AgentVersion],function=min("@timestamp"))
33+
}, include=[aid,ComputerName,AgentVersion,_min], name="time")
34+
| defineTable(query={"#event_simpleName" = OsVersionInfo AgentVersion=*
35+
| event_platform=Mac
36+
| groupBy([aid,ComputerName],function=[selectFromMin(@timestamp,include=AgentVersion)])
37+
| rename(field=AgentVersion,as=Old_Version)}, include=[aid,ComputerName,Old_Version], name="old")
38+
| "#event_simpleName" = OsVersionInfo AgentVersion=*
39+
| event_platform=Mac
40+
| groupBy([aid,ComputerName],function=[selectFromMax(@timestamp,include=[AgentVersion])])
41+
| rename(field=AgentVersion,as=Current_Version)
42+
| match(old, field=[aid])
43+
| match(time, field=[aid,Current_Version],column=[aid,AgentVersion])
44+
| Current_Version=/(?<Short_Current_Version>\d+\.\d+)/
45+
| Old_Version=/(?<Short_Old_Version>\d+\.\d+)/
46+
| if(condition=Current_Version==Old_Version, then="No change", else=if(condition= Short_Current_Version<Short_Old_Version, then="Downgrade", else=if(condition= Short_Current_Version>Short_Old_Version, then="Upgrade", else=0)))
47+
| Status := rename(field="_if")
48+
| "Changed at" := if(condition=Current_Version==Old_Version, then="n/a", else=formatTime(format="%Y/%m/%d %H:%M:%S", field=_min, as="Zeitpunkt"))
49+
| "Old Version" := rename("Old_Version")
50+
| "Current Version" := rename("Current_Version")
51+
| table([ComputerName,aid, "Old Version","Current Version",Status,"Changed at"])
52+

0 commit comments

Comments
 (0)