CCFH-202B: CrowdStrike Certified Falcon Hunter

A negated cidr() filter—!cidr(RemoteAddressIP4, subnet=[...])—passes only events whose remote IPv4 address is outside the specified internal and special-use ranges. The cidr() documentation specifically identifies !cidr(...) as the supported negation form for allowing addresses not in the supplied subnets, and CrowdStrike’s example uses this same pattern to omit internal addresses.