Prove Falcon is working — first tool + proof field

1. Why “is Falcon working?” is five questions

Operators collapse five failures into one sentence. The sensor never checked in. The host is in Reduced Functionality Mode. The IOA fired Detect, not Prevent. The process tree shows a parent the ticket never named. RTR cannot start because the host is dark. Those are five first clicks.

This page is the night-shift desk for proof. The factory taught last-seen, prevent vs detect, IOA, contain, and duplicate AID. Here you learn the five console surfaces you actually open, in order, when someone asks you to prove Falcon is working — or to explain why it did not block.

Hero · five tiles, one ticket

2. Mental model — five proof tools

Memorise five named objects before you click. Each tool is allowed to prove one thing. Over-claiming a field is how you contain the wrong AID or disable Prevent for the tenant at 02:00.

3. Decision flow — ticket → first tool

Flowchart first. Do not open Prevention policies or start RTR until a diamond says so.

Path · pick the branch before the menu

4. How to choose — first tool + proof field

Print this next to the Falcon console. If you cannot recite the proof field, you are not ready to contain or change a slider.

5. Runbook Side A → B → C

Side A proves the sensor is on the wire. Side B proves what Falcon saw and whether policy was allowed to block. Side C proves live response. On a messy Sev-2, do them in this order until a field lights up.

Side A — Host management (sensor status)

1. Open Host management, not Detections

   Path: Host setup and management → Host management. Search hostname. If two rows appear, you have two AIDs — sort by Last Seen and work the live one. Source: CrowdStrike Hosts API (hostname, device_id, last_seen); console path documented under Host Setup and Management.

2. Read the four sensor columns that close “is Falcon working?”

   Last Seen — most recent connection to Falcon (UTC). Sensor version (agent_version). Reduced Functionality Mode — yes / no. Containment status — normal, containment_pending, contained, or lift_containment_pending. Source: Hosts API filter fields.

3. If Last Seen is hours, stop. This is a sensor ticket

   Do not start RTR. Do not contain (you will sit on containment_pending). Do not call it a miss. Check Inactive sensors, filters to the cloud, installation token, and whether a leftover AID is the row you opened. Then come back.

4. If RFM = yes, the sensor is not fully functioning

   RFM means the sensor has reduced capability. Empty or thin detections on that host are expected. Quote RFM. Fix the sensor condition documented for your OS / kernel — do not hunt a Prevention miss.

Side B — Detection, process tree, Prevention policy

1. Open the detection, not Slack’s filename

   Path: Activity → Detections (or the alert object in Next-Gen SIEM). Filter hostname + the UTC window on the ticket. Official Alerts fields: tactic, technique, tactic_id, technique_id, severity, status, assigned_to_name, created_timestamp. Source: CrowdStrike Alerts API.

2. Read tactic / technique / severity / status

   Those four close “what did Falcon think this was?” A Critical Credential Access / T1003 detection is not a hash debate. Assign it. Do not leave status = new while you argue the filename.

3. Open Process Tree before you type RTR

   Detection details → Process Tree. Quote parent process, child, and command line. Official EDR visibility includes process executions and process-level network activity. The tree is historical telemetry. RTR is live. Do not skip the tree to go collect a file you already have in the graph.

4. If the ticket is “why didn’t it block?”, open the assigned Prevention policy

   Path: host card → Prevention policy, or Endpoint security → Configure → Prevention policies. Read the slider that covers this IOA / malware / exploit class. Detect means the product did what that host group is configured to do. Promote to Prevent under change control — do not call it a miss and do not disable the tenant.

Path:            Activity → Detections  (or Next-Gen SIEM alert)
Quote:           tactic + technique + severity + status
Then:            Detection details → Process Tree  (parent → child → command line)
If “no block”:   Endpoint security → Configure → Prevention policies
Quote:           policy name + Detect vs Prevent slider for that IOA class
If empty queue:  Host management Last Seen / RFM first

Side C — Real Time Response + contain

1. Contain a live Credential Access host before you collect souvenirs

   Official EDR name is network containment. Hosts API action: contain / lift_containment. Status becomes containment_pending then contained. A contained host can still talk to the Falcon cloud; the state persists across reboot. Falcon’s word is contain, not isolate. Source: CrowdStrike EDR (network containment); Hosts PerformActionV2.

2. Start RTR only after Last Seen is seconds

   Host page → Real Time Response. Official: you must initialise a session before any command. Sessions expire after five minutes unless refreshed (RTR_PulseSession / batch refresh). A dark host can queue (persist_all) — that is not a collected file.

3. Use the documented command that answers the ticket

   Read-only / responder commands CrowdStrike documents include ps, ls, cat, get, filehash, netstat, kill. Quote the command and the output. RTR is change control — you need the role and, in most shops, a change number before kill / rm / runscript.

6. Five tickets as full stories

These five land every quarter. Memorise first tool + proof field. Times and identities below are lab-only.

CS-ED-01 — Prove the sensor (Host management)

01:42 · P2. Priya on a hotel network. Phone photo of a Falcon tray icon. L1 already drafted “Falcon missed the malware.” Detections for her hostname are empty.

First tool: Host setup and management → Host management. Search FIN-LPTP-04.

If Last Seen is hours / RFM = yes: quote that pair. Empty Detections is expected. Next check is sensor — cloud connectivity, installation token, kernel / RFM condition, leftover AID — not a new custom IOA.

If Last Seen is seconds and RFM = no: the sensor is talking. Now you are allowed to open Detections for that AID and UTC window. A tray icon is not Last Seen.

CS-ED-02 — Prove why it did not block (Prevention policy)

02:05 · P2. An IOA fired. The process is still running. Someone typed “Falcon failed” in the channel and wants Prevent off for Finance so they can work.

First tool: host card → assigned Prevention policy, or Endpoint security → Configure → Prevention policies. Confirm the host group that assigned it.

Proof field: policy name (lab: Finance-Workstation-Detect) and the IOA / malware slider set to Detect. That is the ticket. Falcon did what that group is configured to do. Contain if the tactic is real. Promote the slider under change control. Do not disable ML for the tenant.

CS-ED-03 — Prove the behaviour (Detection + process tree)

02:20 · P1. DET-1042. User still in Outlook. L1 wants to argue whether lsass.bin is the official name.

First tool: Activity → Detections → DET-1042. Then Detection details → Process Tree.

Proof field: tactic = Credential Access, technique = T1003, severity = Critical, status still new; tree shows WINWORD → powershell → rundll32 MiniDump. Last Seen 22s, containment normal. Contain first. Filename later. Reset credentials after the tree names the account.

CS-ED-04 — Prove the live host (RTR)

02:40 · P2. IR wants the script on disk. Someone already typed an RTR get against the 12-day AID.

First tool: Host management Last Seen on the AID you will session, then Host page → Real Time Response.

Proof field: session established + ps showing the PID + get / filehash of the path from the process tree. If Last Seen is hours, RTR will not collect — you may queue with persist, but that is not evidence in the ticket tonight.

CS-ED-05 — Prove the block was policy (Prevention policy)

03:00 · P3. Red team says Falcon broke the demo. Prevention policy on that host group is Aggressive / Prevent. L1 wants ML off until Monday.

First tool: Endpoint security → Configure → Prevention policies for the demo host group.

Proof field: policy name + the Prevent slider that matched the demo tool. A blocked demo can be policy success. Scope a time-boxed host-group exception or IOA exclusion with an owner and an end time. Keep Prevent on for everyone else.

7. Traps + close-the-ticket proof

Proof · named field, then Closed

Sources

• CrowdStrike developer — Hosts API (last_seen, reduced_functionality_mode, status = normal / containment_pending / contained / lift_containment_pending, agent_version, device_id; actions contain, lift_containment, hide_host)
• CrowdStrike developer — Alerts API (tactic, technique, tactic_id, technique_id, severity, status, assigned_to_name, created_timestamp)
• CrowdStrike developer — Detects API (detection state and assignee updates)
• CrowdStrike developer — Real Time Response (init session, refresh, 5-minute expiry, ps, ls, get, filehash, kill)
• CrowdStrike developer — Real Time Response Admin
• CrowdStrike developer — Automate response (RTR sessions, scripts, audit)
• CrowdStrike — What is EDR? (network containment; Real Time Response; process executions)
• CrowdStrike — How to network contain an infected system
• CrowdStrike — Indicators of Attack (IOA)
• CrowdStrike — IOA vs IOC
• CrowdStrike tech-hub — Installing Falcon Sensor for Linux (Host Setup and Management; Host management)
• Falcon documentation portal (confirm current console paths and Prevention policy assignment on your build)
• CrowdStrike support portal

Related: Blog 1 · Last-seen is the first Falcon sentence · CrowdStrike Falcon hub · Dummy lab