Detect locally disabled RTR
This query identifies hosts with locally disabled RTR.
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=SensorHeartbeat
| groupBy([aid], function=selectLast([@timestamp, ComputerName, SensorStateBitMap]), limit=max)
| bitfield:extractFlags(
field=SensorStateBitMap,
output=[
[2, RTR_Locally_Disabled]
])
| RTR_Locally_Disabled="true"detect_locally_disabled_rtr.yml
CrowdStrike
Monitoring
Endpoint
Insight
2025-08-26
2025-10-29
