ByteRay CQL Hub
← All queries

Domain Controllers with high load

Domain controllers with either average CPU usage, average RAM usage that exceeds 80% or Available Disk space < 10GB. This indicates low capacity or unexpected excessive usage.

CQL · Falcon Next-Gen SIEMCopy query
//Table to list DC hardware capacity
| defineTable(query={#repo=base_sensor #event_simpleName="SystemCapacity"
| in(field=cid, values=[?SelectedCid])
| match(file="aid_master_main.csv", field=[cid, aid])
| ProductType=2
// Filters
| in(field=MachineDomain, values=[?SelectedDomain])
| groupBy([cid, aid], function=selectLast([CpuProcessorName, PhysicalCoreCount, LogicalCoreCount, MemoryTotal]), limit=5000)
| MemoryTotal := unit:convert(field=MemoryTotal, to=Gi)
}, include=[cid, aid, MemoryTotal, LogicalCoreCount], name="system_capacity", start=3d)

| #repo=base_sensor #event_simpleName=ResourceUtilization
| in(field=cid, values=[?SelectedCid])
// Filter only on DC
| match(file="aid_master_main.csv", field=[cid, aid]) | ProductType=2

// Filters
| in(field=MachineDomain, values=[?SelectedDomain])

| groupBy([cid, aid], function=[ avg(AverageUsedRam, as=AverageUsedRam), avg(AverageCpuUsage, as=AverageCpuUsage), selectLast([UsedDiskSpace, AvailableDiskSpace])], limit=5000)

// Get DC capacity
| match(file="system_capacity", field=[cid, aid], strict=false)

// Memory capacity & usage
| AverageUsedRam := unit:convert(field=AverageUsedRam, from=Mi, to=Gi)
| AverageUsedRam := (AverageUsedRam/MemoryTotal)*100

| ThresholdMemory:=80
| ThresholdCPU:=80
| ThresholdDiskSpace:=10
| HighUsage:= false
| case {
  test(AverageUsedRam>=ThresholdMemory) | HighUsage:= true;
  test(AverageCpuUsage>=ThresholdCPU) | HighUsage:= true;
  test(AvailableDiskSpace<ThresholdDiskSpace) | HighUsage:= true;
}
| stats({HighUsage="true"| count(field=aid, distinct=true)})
domain_controllers_with_high_load.yml
CrowdStrike
Monitoring
Endpoint
Insight
2025-10-30
2025-10-30

Get this query running in your SIEM, with someone on call.

Our Managed SIEM team operates CrowdStrike Falcon Next-Gen SIEM in production, with over 350 battle-tested use cases and 24/7 incident response behind them.

Talk to the SIEM team