Devices in RFM state

CQL · Falcon Next-Gen SIEMCopy query

#event_simpleName=OsVersionInfo
| groupBy([aid, ComputerNam, RFMState], function=selectLast([@timestamp]))
| RFMState = 1

rfm_state.yml

ByteRay

Monitoring

Endpoint

Insight

2025-08-06

2025-10-27

Get this query running in your SIEM, with someone on call.

Our Managed SIEM team operates CrowdStrike Falcon Next-Gen SIEM in production, with over 350 battle-tested use cases and 24/7 incident response behind them.

Talk to the SIEM team