Source
r/crowdstrike•
aringa

Crowdstrike Emails

Feature Question

We're a new CS customer and I have a couple of questions. I'm getting dozens and dozens of alerts, most of which, it doesn't look like there is much that i can do anway. What do you do with your alerts and do you get many? At this point, it doesn't look like there is a way to filter what alerts you get and which ones you don't.

I'm tempted to just turn them off or have a mailbox rule move them to a folder, but I know in a week I'll neever look in there again.

Posted Nov 4, 2020, 5:48 PM UTC

13
BradW-CSCS SE•

Hey u/aringa -- Are there any similarities in the alerts? Your next step would be determine if these are true, false positives (ie: the tool needs to be tuned) or can be ignored entirely as it's expected behavior.

Read over the documentation regarding exclusions and circle back with us or your TAM/SE: https://falcon.crowdstrike.com/support/documentation/69/incident-and-detection-monitoring

Regards,

Brad W

6
aringaOP•

Many of the "High" ones are DEP prevention and all are generated by iexplore.exe. Some of them are executables that aren't real detections, but one that I want to block. I don't need to get emails about either of those. I opened a ticket about the DEP ones and support didn't know what it was either or how to troubleshoot.

1
Pain-Potatoes•

If you're getting lots of alerts then you need to either reduce your prevention policies detection threshold or investigate them.

I've been a CS customer for almost a year now and I don't that that many false positives. Certainly not enough to make me want to ignore them entirely. If you ignore them then what if you get a genuine malware outbreak?

Something else is wrong inside your environment and you need to start looking there to figure this one out.

4