Domain Controllers with high load
Domain controllers with either average CPU usage, average RAM usage that exceeds 80% or Available Disk space < 10GB. This indicates low capacity or unexpected excessive usage.
EDRmonitoring
FDR intermediatepor CrowdStrike (cql-hub.com) 1 min read
Query
//Table to list DC hardware capacity
| defineTable(query={#repo=base_sensor #event_simpleName="SystemCapacity"
| in(field=cid, values=[?SelectedCid])
| match(file="aid_master_main.csv", field=[cid, aid])
| ProductType=2
// Filters
| in(field=MachineDomain, values=[?SelectedDomain])
| groupBy([cid, aid], function=selectLast([CpuProcessorName, PhysicalCoreCount, LogicalCoreCount, MemoryTotal]), limit=5000)
| MemoryTotal := unit:convert(field=MemoryTotal, to=Gi)
}, include=[cid, aid, MemoryTotal, LogicalCoreCount], name="system_capacity", start=3d)
| #repo=base_sensor #event_simpleName=ResourceUtilization
| in(field=cid, values=[?SelectedCid])
// Filter only on DC
| match(file="aid_master_main.csv", field=[cid, aid]) | ProductType=2
// Filters
| in(field=MachineDomain, values=[?SelectedDomain])
| groupBy([cid, aid], function=[ avg(AverageUsedRam, as=AverageUsedRam), avg(AverageCpuUsage, as=AverageCpuUsage), selectLast([UsedDiskSpace, AvailableDiskSpace])], limit=5000)
// Get DC capacity
| match(file="system_capacity", field=[cid, aid], strict=false)
// Memory capacity & usage
| AverageUsedRam := unit:convert(field=AverageUsedRam, from=Mi, to=Gi)
| AverageUsedRam := (AverageUsedRam/MemoryTotal)*100
| ThresholdMemory:=80
| ThresholdCPU:=80
| ThresholdDiskSpace:=10
| HighUsage:= false
| case {
test(AverageUsedRam>=ThresholdMemory) | HighUsage:= true;
test(AverageCpuUsage>=ThresholdCPU) | HighUsage:= true;
test(AvailableDiskSpace<ThresholdDiskSpace) | HighUsage:= true;
}
| stats({HighUsage="true"| count(field=aid, distinct=true)})Explicación
Importado desde cql-hub.com. Agrega explicación de pipes aquí.
Variables a ajustar
Revisa y ajusta los valores según tu entorno.