• b161
    link
    fedilink
    English
    arrow-up
    2
    ·
    2 months ago

    Do you know if the sensor update policy had been set to N-2 would this have avoided the issue?

    • starneld@infosec.pub
      link
      fedilink
      English
      arrow-up
      7
      ·
      2 months ago

      Setting the update policy to N-2 (or any other configuration) would not have avoided the issue. The Falcon sensor itself wasn’t updated, which is what the update policy controls. As it turns out, you cannot control the content channel updates - you simply always get the updates.

      • b161
        link
        fedilink
        English
        arrow-up
        1
        ·
        2 months ago

        💀 Fucking hell CrowdStrike.