ByteRay CQL Hub
← All queries

Cloud Least Privilege IOMs

This query outputs all identified indicators of misconfigurations (IOMs) related to least privilege.

CQL · Falcon Next-Gen SIEMCopy query
CloudService="IAM" | in(field="policy_id", values=["5", "612", "401", "461", "7", "611", "444", "190", "203", "6", "563", "610"])
| groupBy(["policy_statement"])
cloud_least_privilege_ioms.yml
CrowdStrike
Monitoring
Cloud
CSPM / ASPM / DSPM
2025-08-26
2025-11-01

Get this query running in your SIEM, with someone on call.

Our Managed SIEM team operates CrowdStrike Falcon Next-Gen SIEM in production, with over 350 battle-tested use cases and 24/7 incident response behind them.

Talk to the SIEM team