Domain Controllers with VMware NSX introspection drivers loaded
Finds Domain Controllers where the VMware NSX Guest Introspection drivers are loaded: vsepflt.sys (file introspection), vnetflt.sys / vnetWFP.sys (network introspection). The network drivers hook the Windows Filtering Platform (WFP), as the Falcon sensor does; on DCs this can add latency and reduce traffic analysis visibility. Shows sensor-online ("reboot") times next to NSX driver load times for each DC. Data: AgentOnline + DriverLoad events, aid_master_main.csv lookup (ProductType 2 = DC) Notes: - Both events fire mainly at boot / sensor start, so use a time range that covers at least one patch cycle (e.g. 30 days). - AgentOnline can fire more than once per boot, so one reboot may show several times.
CQL
