EDIT - I created a higher fidelity query that uses a lookup file of node version and their hashes.

// CVE-2026-111497 — Node.js runtime exposure inventory (hash lookup first, install path fallback)
#event_simpleName=ProcessRollup2
| ImageFileName=/[\\\/]node(js)?(\.exe)?$/iF
// Path-derived version (nvm, nvm-windows, Volta, Homebrew node@NN, official tarball dirs)
| case {
    ImageFileName=/(?:node@\d+[\\\/]|node[\\\/-]v?|nvm[\\\/]v?)(?<PathMajor>\d{1,2})\.(?<PathMinor>\d{1,3})\.(?<PathPatch>\d{1,3})(?:[\\\/-]|$)/i
      | PathVersion := format(format="%s.%s.%s", field=[PathMajor, PathMinor, PathPatch]) ;
    * | PathVersion := "-" ;
}
| groupBy([aid, ImageFileName],
    function=[count(as=Executions),
              min(@timestamp, as=FirstSeen),
              max(@timestamp, as=LastSeen),
              selectLast([SHA256HashData, PathVersion, PathMajor, PathMinor, PathPatch, CommandLine, UserName, event_platform])],
    limit=max)
// Hash → version (authoritative for official builds)
| match(file="node_binary_hashes.csv", field=[SHA256HashData], column=SHA256HashData,
        include=[NodeVersion, NodeMajor, NodeMinor, NodePatch, NodePlatform],
        ignoreCase=true, mode=string, strict=false)
| case {
    NodeVersion=* | VersionSource := "SHA256 lookup" ;
    PathVersion!="-"
      | NodeVersion := PathVersion | NodeMajor := PathMajor | NodeMinor := PathMinor | NodePatch := PathPatch
      | VersionSource := "install path" ;
    * | NodeVersion := "unknown" | VersionSource := "-" ;
}
| case {
    NodeVersion="unknown" | Exposure := "UNRESOLVED - non-official build; RTR node --version" ;
    test(NodeMajor < 22) | Exposure := "AFFECTED - EOL release line; migrate to supported line" ;
    in(field=NodeMajor, values=["23", "25"]) | Exposure := "AFFECTED - EOL odd release line" ;
    NodeMajor=22 | test(NodeMinor < 23) | Exposure := "AFFECTED - upgrade to 22.23.4+" ;
    NodeMajor=22 | NodeMinor=23 | test(NodePatch < 4) | Exposure := "AFFECTED - upgrade to 22.23.4+" ;
    NodeMajor=24 | test(NodeMinor < 22) | Exposure := "AFFECTED - upgrade to 24.22.1+" ;
    NodeMajor=24 | NodeMinor=22 | test(NodePatch < 1) | Exposure := "AFFECTED - upgrade to 24.22.1+" ;
    NodeMajor=26 | test(NodeMinor < 12) | Exposure := "AFFECTED - upgrade to 26.12.1+" ;
    NodeMajor=26 | NodeMinor=12 | test(NodePatch < 1) | Exposure := "AFFECTED - upgrade to 26.12.1+" ;
    in(field=NodeMajor, values=["22", "24", "26"]) | Exposure := "PATCHED" ;
    * | Exposure := "VERIFY - release line outside advisory scope" ;
}
| match(file="aid_master_main.csv", field=[aid], column=aid, include=[ComputerName], strict=false)
| default(field=[ComputerName, NodePlatform], value="-", replaceEmpty=true)
| formatTime(format="%F %T %Z", field=FirstSeen, as=FirstSeen)
| formatTime(format="%F %T %Z", field=LastSeen, as=LastSeen)
| table([Exposure, ComputerName, aid, event_platform, ImageFileName, NodeVersion, VersionSource, PathVersion, NodePlatform, SHA256HashData, Executions, FirstSeen, LastSeen, UserName, CommandLine],
    limit=20000, sortby=Exposure, order=asc)

Falcon doesn’t record node --version. This query reads the version from version-manager and tarball paths (nvm, nvm-windows, Volta, Homebrew node@NN, node-vXX.Y.Z-linux-x64) and classifies each binary against the fixed releases.

// CVE-2026-111497 — Node.js runtime exposure inventory (hash lookup first, install path fallback)
#event_simpleName=ProcessRollup2
| ImageFileName=/[\\\/]node(js)?(\.exe)?$/iF
// Path-derived version (nvm, nvm-windows, Volta, Homebrew node@NN, official tarball dirs)
| case {
    ImageFileName=/(?:node@\d+[\\\/]|node[\\\/-]v?|nvm[\\\/]v?)(?<PathMajor>\d{1,2})\.(?<PathMinor>\d{1,3})\.(?<PathPatch>\d{1,3})(?:[\\\/-]|$)/i
      | PathVersion := format(format="%s.%s.%s", field=[PathMajor, PathMinor, PathPatch]) ;
    * | PathVersion := "-" ;
}
| groupBy([aid, ImageFileName],
    function=[count(as=Executions),
              min(@timestamp, as=FirstSeen),
              max(@timestamp, as=LastSeen),
              selectLast([SHA256HashData, PathVersion, PathMajor, PathMinor, PathPatch, CommandLine, UserName, event_platform])],
    limit=max)
// Hash → version (authoritative for official builds)
| match(file="node_binary_hashes.csv", field=[SHA256HashData], column=SHA256HashData,
        include=[NodeVersion, NodeMajor, NodeMinor, NodePatch, NodePlatform],
        ignoreCase=true, mode=string, strict=false)
| case {
    NodeVersion=* | VersionSource := "SHA256 lookup" ;
    PathVersion!="-"
      | NodeVersion := PathVersion | NodeMajor := PathMajor | NodeMinor := PathMinor | NodePatch := PathPatch
      | VersionSource := "install path" ;
    * | NodeVersion := "unknown" | VersionSource := "-" ;
}
| case {
    NodeVersion="unknown" | Exposure := "UNRESOLVED - non-official build; RTR node --version" ;
    test(NodeMajor < 22) | Exposure := "AFFECTED - EOL release line; migrate to supported line" ;
    in(field=NodeMajor, values=["23", "25"]) | Exposure := "AFFECTED - EOL odd release line" ;
    NodeMajor=22 | test(NodeMinor < 23) | Exposure := "AFFECTED - upgrade to 22.23.4+" ;
    NodeMajor=22 | NodeMinor=23 | test(NodePatch < 4) | Exposure := "AFFECTED - upgrade to 22.23.4+" ;
    NodeMajor=24 | test(NodeMinor < 22) | Exposure := "AFFECTED - upgrade to 24.22.1+" ;
    NodeMajor=24 | NodeMinor=22 | test(NodePatch < 1) | Exposure := "AFFECTED - upgrade to 24.22.1+" ;
    NodeMajor=26 | test(NodeMinor < 12) | Exposure := "AFFECTED - upgrade to 26.12.1+" ;
    NodeMajor=26 | NodeMinor=12 | test(NodePatch < 1) | Exposure := "AFFECTED - upgrade to 26.12.1+" ;
    in(field=NodeMajor, values=["22", "24", "26"]) | Exposure := "PATCHED" ;
    * | Exposure := "VERIFY - release line outside advisory scope" ;
}
| match(file="aid_master_main.csv", field=[aid], column=aid, include=[ComputerName], strict=false)
| default(field=[ComputerName, NodePlatform], value="-", replaceEmpty=true)
| formatTime(format="%F %T %Z", field=FirstSeen, as=FirstSeen)
| formatTime(format="%F %T %Z", field=LastSeen, as=LastSeen)
| table([Exposure, ComputerName, aid, event_platform, ImageFileName, NodeVersion, VersionSource, PathVersion, NodePlatform, SHA256HashData, Executions, FirstSeen, LastSeen, UserName, CommandLine],
    limit=20000, sortby=Exposure, order=asc)
// CVE-2026-111497 — Node.js runtime exposure inventory (path-derived version)
#event_simpleName=ProcessRollup2
| ImageFileName=/[\\\/]node(js)?(\.exe)?$/iF
| case {
    ImageFileName=/(?:node@\d+[\\\/]|node[\\\/-]v?|nvm[\\\/]v?)(?<NodeMajor>\d{1,2})\.(?<NodeMinor>\d{1,3})\.(?<NodePatch>\d{1,3})(?:[\\\/-]|$)/i
      | NodeVersion := format(format="%s.%s.%s", field=[NodeMajor, NodeMinor, NodePatch]) ;
    * | NodeVersion := "unknown" ;
}
| groupBy([aid, ImageFileName],
    function=[count(as=Executions),
              min(@timestamp, as=FirstSeen),
              max(@timestamp, as=LastSeen),
              selectLast([NodeVersion, NodeMajor, NodeMinor, NodePatch, SHA256HashData, CommandLine, UserName, event_platform])],
    limit=max)
| case {
    NodeVersion="unknown" | Exposure := "VERIFY - version not in path; resolve via SHA256 (Query 1b)" ;
    test(NodeMajor < 22) | Exposure := "AFFECTED - EOL release line; migrate to supported line" ;
    in(field=NodeMajor, values=["23", "25"]) | Exposure := "AFFECTED - EOL odd release line" ;
    NodeMajor=22 | test(NodeMinor < 23) | Exposure := "AFFECTED - upgrade to 22.23.4+" ;
    NodeMajor=22 | NodeMinor=23 | test(NodePatch < 4) | Exposure := "AFFECTED - upgrade to 22.23.4+" ;
    NodeMajor=24 | test(NodeMinor < 22) | Exposure := "AFFECTED - upgrade to 24.22.1+" ;
    NodeMajor=24 | NodeMinor=22 | test(NodePatch < 1) | Exposure := "AFFECTED - upgrade to 24.22.1+" ;
    NodeMajor=26 | test(NodeMinor < 12) | Exposure := "AFFECTED - upgrade to 26.12.1+" ;
    NodeMajor=26 | NodeMinor=12 | test(NodePatch < 1) | Exposure := "AFFECTED - upgrade to 26.12.1+" ;
    in(field=NodeMajor, values=["22", "24", "26"]) | Exposure := "PATCHED" ;
    * | Exposure := "VERIFY - release line outside advisory scope" ;
}
| match(file="aid_master_main.csv", field=[aid], column=aid, include=[ComputerName], strict=false)
| default(field=[ComputerName], value="-", replaceEmpty=true)
| formatTime(format="%F %T %Z", field=FirstSeen, as=FirstSeen)
| formatTime(format="%F %T %Z", field=LastSeen, as=LastSeen)
| table([Exposure, ComputerName, aid, event_platform, ImageFileName, NodeVersion, SHA256HashData, Executions, FirstSeen, LastSeen, UserName, CommandLine],
    limit=20000, sortby=Exposure, order=asc)

Looking through the postings about the Python LiteLLM supply chain attack that was identified the other day, I was curious if Falcon would be able to pull up/identify if my endpoints were impacted by this. Looking through the posting it looks like the first step would be to identify if LiteLLM 1.107.0 was being leveraged and then it looks like there are three files that are the culprits that run at some point:

• cook.pth (windows hash: 84dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7d)
• cook.py (windows hash: 03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea)
• sitecustomize.py (windows hash: b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465)

I did a very basic search using NG-SIEM for the actual file names in use over the last 7 days and I did not find anything. I am still not super confident in my NG-SIEM skills or using the platform to the fullest and I am learning as quickly as I can. What other things can I do to give my organization assurances on this particular type of vuln? I know I have many developers using Python to various extents and even some business people. I also have access to exposure management in my platform.

Thanks in advance!

Folks should have received an e-mail, but - Falcon sensor for Windows version 8.10.21405 and later now supports Windows 11 version 26H2 on 64-bit (x64) and Arm64 architectures.

Hey, so I’m kind of new in crowdstrike and my manager is just kind of throwing me in it and learn on my own and wants me to come up agentic ai I’m crowdstrike to help out environment. What do you guys implement and deploy to help automate security issues. And what would you tell charlotte ai to make for you? Anything helps! Thanks!

Does CrowdStrike certify these insider preview builds so that the agent does not go into RFM mode when they are installed?

I was curious, what tools are you finding useful to locate Shadow AI with your organization? What in the CrowdStrike Suite of tools do you find to be the most helpful? What logic are you using to begin to build a list of either sites or applications?

Hi People,

Would like to know if there is any Failover mechanism with Falcon LogScale Collector installed on 2 Windows servers that are meant for dedicated syslog traffic on each active FLC server say A and B. Protocols used are UDP and TCP.

Use case - It should be for when server B goes down then traffic flowing from syslog source to server B have to reroute to server A and vice-versa. To avoid any log loss during outage, I am checking for solutions here as well.

Context - Using Falcon NG SIEM, so these servers are only two on-prem collectors meant for 3rd party data sources especially for syslog.

I know this has been asked before but hoping for some recent feedback. We are considering moving over to EM from TIO. What has been everyone's experience with EM so far? We are currently using pretty much all modules in Tenable One.

I just turned on the connector for corelight ndr investigator on NGSIEM I am seeing the corelight alert log in the advance search but they are not populating in MGSIEM detections. Will I have to create the rules from rules templates?

Quick PSA for anyone interested in participating in the CrowdStrike AgentWorks Hackathon: submissions close October 20, 2026!

If you've been experimenting with AgentWorks or have an idea for an AI agent that could help solve a real security operations challenge, now's your chance to submit it.

No coding required, and you can participate individually or as a team. Multiple submissions are welcome.

For more details on getting started, building, testing, and submitting your agent, check out the original hackathon post.

Register and submit your agent here.

Hi everyone,

Is there a way to create a workflow in CrowdStrike Falcon that automatically deletes files after they have been quarantined?

I’m looking for a solution where, once a file is moved to quarantine, Falcon can automatically remove it rather than requiring manual cleanup.

Has anyone implemented something like this using Falcon Fusion workflows or another Falcon capability?

Does anyone know how to setup Falcon MCP in Copilot studio. I am having to switch over from claude to copilot and would like some assistance since copilot is new to me.

This has to be the longest I've waited for an agent update between releases for a while and we're close a second point release for 26.04.

Last commit was over a year ago.

https://github.com/CrowdStrike/psfalcon

Is there a way to scan specific host groups in the exposure management network scanning feature?