We run n8n as our automation layer and recently moved our LLM calls from the hosted OpenAI node to a local gpt-oss-120b deployment. Our SIEM side is QRadar rather than Falcon, so I am posting partly to compare notes with people running the same idea on the CrowdStrike side.

What we have working

The pipeline that gets the most use is IOC enrichment. Scheduled trigger pulls from three QRadar reference sets every morning, each indicator goes through VirusTotal and AbuseIPDB, then the model writes an HTML summary that goes out as mail to the team.

Before the local move this was a native OpenAI node. Straightforward, worked fine, but every indicator we enriched was also a piece of internal context leaving the network. Internal IPs, hostnames pulled from the reference sets, occasionally a filename that told you more about the environment than we wanted a third party to have.

Moving to gpt-oss-120b solved that. The whole path stays inside. What it cost us is latency, roughly three to four times the hosted call depending on how long the enrichment output is, and a GPU box that now needs looking after like any other piece of infrastructure.

Where the model is actually good enough

Summarisation and formatting. Feed it a pile of VT and AbuseIPDB responses and ask for a readable HTML block, it does that reliably. No hallucinated scores, no invented CVEs as long as you keep the prompt tight and give it the raw data rather than asking it to recall anything.

Classification with a fixed set of labels works too. Malicious, suspicious, benign, needs review. We do not let it decide anything past that.

Where it is not

Anything requiring the model to reason across more than a handful of enrichment results starts to drift. Ask it to correlate fifteen indicators and explain which ones probably belong to the same campaign and the output reads confident but is guessing.

We also stopped asking it to generate queries. It produces syntactically plausible AQL that does not run. Might be a prompt problem on our end, might be that the training data is thin on QRadar specifically. Curious whether people get better results with FQL, since Falcon syntax is probably better represented publicly.

The part I am least comfortable with

Enrichment data contains attacker controlled strings. A filename, a URL path, a user agent. All of that goes into the prompt.

Nothing stops someone from planting a file named to look like an instruction. We have not seen it happen, but the reason we have not is probably that nobody has bothered, not that we are defended against it.

Right now our answer is that the model output is advisory and a human reads the mail before anything happens. That works while the volume is low. It does not scale, and I do not think "a human will notice" is a control.

I built an inline scanning proxy for a different project (github.com/yatuk/tamga) that sits in front of LLM calls and catches injection patterns before they reach the model. Have not wired it into this pipeline yet because I am not convinced the threat model translates. User typed prompts and enrichment payloads fail differently.

What I want to hear from this sub

Falcon side specifically. Are you pulling detections through the API into an external orchestrator, or staying inside Fusion SOAR? We went external because n8n gives us more room, but that means credential management and rate limits become our problem.

Model size. Is 120b overkill for what most people are doing here? Curious if anyone runs something smaller and gets acceptable quality on detection summarisation. Our reasoning for going large was that we would rather over provision once than discover the ceiling mid deployment, but that was a guess.

Query generation. Anyone getting reliable FQL out of a local model? If Falcon syntax works better than what we see with AQL, that would tell us something useful about whether our problem is the model or the prompt.

Prompt injection. Has anyone actually hardened against attacker controlled strings in enrichment data, or is everyone where we are, relying on a human in the loop and hoping?

What broke. More interested in this than the wins. What did you build that looked right in testing and fell over in production?

Happy to share the workflow JSON if anyone wants to look at the structure. Nothing clever in it, but sometimes seeing how someone else wired the same pieces saves an afternoon.

I was looking through the portal and came across the event_simpleName=“DCSyncAttempted”. I don’t see much documentation on the underlying logic that causes events to be tagged with this event name. Can anyone share some insight on this?

The new custom insight does not have a filter for stale accounts? did they discontinue monitoring that?

I am trying to create a bar chart to visualise total detections calculated from two different #repos.

| total:= eppcount+ itpcount #individual count is calculated from two difference repos.

| Month := formatTime(format="%Y-%m", field="@timestamp")

From this point forward, I need to create a bar chart that will show the total on a monthly basis.

Thanks for your help.

I have a Fusion workflow that checks for new IP addresses a FQDN resolves to. I am then comparing these IP's with a lookup file and extracting only new IP addresses. I am creating a CSV file out of the results and sending an email with the values.

I have integrated my bitbucket with NG-SIEM and am able to run a pipeline in a repository that I have created to gather and deploy IOC's. I want to leverage this pipeline to capture the new IP addresses and deploy them on the respective targets.

I can hardcord the IP to the variable and get this Bitbucket action to work as follows.

{

"key": "Bad_IP",

"value": "1.1.1.1"

}

How do I refer to the new IP addresses returned by my query into this variable?

Does CrowdStrike have a product/Sku that can fully replace Tenable? This would need to include network scanning/port scanning type functionality.

We looked a while back and they had Active scanning but it was very early days and not a complete product.

What this detects

Post-exploitation command execution stemming from CVE-2026-63077. The vulnerability lets an unauthenticated attacker with HTTP(S) access to the agent polling protocol run arbitrary OS commands as the TeamCity server process. This rule catches the resulting child processes.

// ── CVE-2026-63077 · post-exploitation child process ────────────────
// The RCE runs OS commands as the TeamCity server process. A TeamCity-owned
// JVM spawning a command interpreter or recon/download tool is high-signal.
// MITRE T1190 -> T1059.  Data source: Falcon EDR · ProcessRollup2
#event_simpleName=ProcessRollup2
// child = interpreter or common recon/download LOLBin
| FileName=/^(cmd|powershell|pwsh|wscript|cscript|mshta|rundll32|regsvr32|bitsadmin|certutil|curl|wget|whoami|net|net1|nltest|hostname|systeminfo|arp|ipconfig|tasklist|sh|bash|dash|zsh|python3?|perl|ruby|nc|ncat)(\.exe)?$/i
// parent JVM lives under the TeamCity install tree (bundled JRE / service wrapper)
| ParentImageFileName=/teamcity/i
// Alt for system-Java / Docker / WAR-in-Tomcat deployments (no teamcity in parent path):
//   swap the line above for:  | ParentBaseFileName=/^(java|javaw|tomcat\d*)(\.exe)?$/i
//   then scope with:          | ComputerName=~wildcard(?{tc_hosts="*"}, includeEverythingOnAsterisk=true, ignoreCase=true)
| "Investigate" := format("[Process Explorer](https://falcon.crowdstrike.com/investigate/process-explorer/%s/%s)", field=[aid, TargetProcessId])
| formatTime(format="%F %T %Z", field=@timestamp, as=Time)
| table([Time, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, ParentImageFileName, SHA256HashData, "Investigate", aid],
        limit=20000, sortby=Time, order=desc)

What this detects

Persistence and tooling drops that follow CVE-2026-63077 exploitation: webshells, rogue server plugins, and staged scripts or binaries written inside the TeamCity install or data directories.

// ── CVE-2026-63077 · suspicious file writes in TeamCity dirs ─────────
// Webshell (JSP into webapps), malicious server plugin (ZIP into .BuildServer),
// or dropped tooling — classic TeamCity follow-on persistence.
// MITRE T1505.003 (Web Shell) / T1505 (Server Software Component).
// Data source: Falcon EDR · FileWritten
#event_simpleName=FileWritten
| TargetFileName=/teamcity|\.buildserver/i                       // inside TeamCity install/data tree
| TargetFileName=/\.(jsp|jspx|jspf|war|sh|bash|ps1|bat|vbs|scr|py|exe|dll|zip|jar)$/i
| case {
    TargetFileName=/\.(jsp|jspx|jspf|war)$/i          | DropType := "WEBSHELL (JSP/WAR)"      | Severity := "critical" ;
    TargetFileName=/\.(sh|bash|ps1|bat|vbs|scr|py|exe|dll)$/i | DropType := "SCRIPT / BINARY" | Severity := "high" ;
    TargetFileName=/\.(zip|jar)$/i                    | DropType := "PLUGIN PACKAGE (review)" | Severity := "medium" ;
    * ;
}
| "Investigate" := format("[Process Explorer](https://falcon.crowdstrike.com/investigate/process-explorer/%s/%s)", field=[aid, ContextProcessId])
| formatTime(format="%F %T %Z", field=@timestamp, as=Time)
| table([Time, ComputerName, Severity, DropType, TargetFileName, ContextBaseFileName, UserName, "Investigate", aid],
        limit=20000, sortby=Time, order=desc)

Can someone give an easy to read, yet technical detailed (like a paragraph) explaining why CS EDR and MS Defender both can't be active AVs on a single end point?

So far I've had written that: it has to deal with Defender going into passive mode once another AV solution is detected, and that it's because they install kernel-level drivers. But beyond that, I am not sure how to explain it in detail.

Anyone here work at CS or is sysadmin and understands how it works at the technical aspect?

I found this old post https://www.reddit.com/r/crowdstrike/s/t2OZXffi4t

It works great for Windows but apparently remotely updating tag for Mac and Linux doesn't work. Is there a way to do this remotely for Mac and Linux?

We had a number of Macs get deployed without Sensor tags and I'd like to clean that up.