Need to identify assets (Cloud, On-Prem, Hybrid) missing CrowdStrike Falcon Sensor using Surface Command Advanced Query

Surface Command
1

Trying to identify assets (cloud, on-prem, and hybrid) that do not have CrowdStrike Falcon Sensor installed using Surface Command Advanced Query.

I can see CrowdStrike software records and Asset → Software relationships, but I'm unable to build a query that reliably returns assets missing CrowdStrike. Looking for a recommended query or best practice.

2

We provide a shortcut for the (:Asset)-->(:Software) in the form of the array property Asset:installed_software.

So, I think you can get your results like this:

MATCH (a:Asset)
WHERE NOT a.installed_software ICONTAINS 'CrowdStrike Sensor Platform'
RETURN a
3

You could also accomplish this by filtering in-UI by Sources. An asset search with Sources does not include Crowdstrike might do the trick.

image
image2288×1330 238 KB