Check Domain Controller for NSX Driver

# --- Query Metadata ---
# Human-readable name for the query. Will be displayed as the title.
name: Check Domain Controller for NSX Driver

# Description of what the query does and its purpose.
description: |
  This query helps to determine if NSX drivers are installed on Domain Controllers to investigate limited Identity Protection functionality.

# The author or team that created the query.
author: ByteRay GmbH

# The required log sources to run this query successfully in Next-Gen SIEM.
log_sources:
  - Endpoint

# The CrowdStrike modules required to run this query.
cs_required_modules:
  - Insight

# Tags for filtering and categorization.
tags:
  - Monitoring

# --- Query Content ---
# The actual CrowdStrike Query Language (CQL) code.
# Using the YAML block scalar `|` allows for multi-line strings.
cql: |
  event_platform=/Win/i #event_simpleName=/DriverLoad/i 
  | in(field=FileName,values=["vnetwfp.sys", "vnetflt.sys"],ignoreCase=true) 
  | join({$falcon/investigate:aid_master()}, field=aid, key=aid, include=[ProductType]) 
  | ProductType=2 
  | "Domain Controller":=ComputerName 
  | LocalIP:=LocalAddressIP4 
  | Drivers:=FileName 
  | groupBy([aid,"Domain Controller",LocalIP,Drivers],function=[])

# Explanation of the query.
# Using the YAML block scalar `|` allows for multi-line strings.
# Uses markdown for formatting on the webpage.
explanation: |
  ## Related CrowdStrike KBs
  
  1. [Resolving Falcon Identity Protection conflicting with VMware tools and NSX Driver](https://supportportal.crowdstrike.com/s/article/ka16T000001Mle7QAC)  
  2. [Verify NSX driver installation on Domain Controllers](https://supportportal.crowdstrike.com/s/article/ka16T000001tkTHQAY)