Inspected LDAP / Kerberos / DCE/RCP Traffic

Shows inspected traffic requests over time on the selected domain controller

CQL · Falcon Next-Gen SIEMCopy query

#repo=base_sensor #event_simpleName=/^ActiveDirectory(?:(?!Audit|Account).)*$/i
| aid=?SelectedAid
| case {
  ActiveDirectoryDataProtocol=0 | Protocol:="LDAP";
  ActiveDirectoryDataProtocol=1 | Protocol:="DCE/RPC";
  ActiveDirectoryDataProtocol=2 | Protocol:="SMB";
  ActiveDirectoryAuthenticationMethod=/[1,2,5]/F | Protocol:="NTLM";
  ActiveDirectoryAuthenticationMethod=0 | Protocol:="Kerberos";
}
| timeChart(span=15m, series=Protocol, function=sum("AggregationActivityCount"))

inspected_ldap___kerberos___dce_rcp_traffic.yml

CrowdStrike

Monitoring

Identity

2025-08-26

2025-10-30

Inspected LDAP / Kerberos / DCE/RCP Traffic

Get this query running in your SIEM, with someone on call.