What caused the sudden spike in false positives for CrowdStrike's Falcon Insight EDR last week?

Introduction

The sudden spike in false positives for CrowdStrike's Falcon Insight EDR last week presents a critical issue that demands immediate attention and thorough analysis. As we delve into this problem, we'll employ a systematic approach to identify, validate, and address the root cause while considering both short-term fixes and long-term implications for the product.

Step 1

Clarifying Questions (3 minutes)

• Looking at the timing, I'm thinking there might have been a recent update. Has there been any software or configuration changes to Falcon Insight EDR in the past week?

Why it matters: Recent changes often correlate with performance issues. Expected answer: Yes, a minor update was pushed last Tuesday. Impact on approach: If confirmed, we'd focus on the update's contents and rollout process.

• Considering the nature of EDR systems, I'm wondering about the scale. What percentage increase in false positives are we seeing compared to the baseline?

Why it matters: The magnitude helps prioritize the issue and narrow down potential causes. Expected answer: A 30-40% increase in false positives. Impact on approach: A significant increase would suggest a systemic issue rather than an edge case.

• Given the complexity of threat detection, I'm curious about the types of false positives. Are they concentrated in specific threat categories or spread across all detections?

Why it matters: Pattern in false positives could indicate issues with specific detection algorithms. Expected answer: Concentrated in network-based threat detections. Impact on approach: Would focus on network traffic analysis components of the EDR.

• Thinking about external factors, have there been any notable changes in the threat landscape or major security events in the past week?

Why it matters: External events can sometimes trigger changes in system behavior. Expected answer: No significant changes reported. Impact on approach: Would shift focus more towards internal factors if confirmed.