CrowdStrike has blamed a bug in its own test software for the mass-crash-event it caused last week. A Wednesday update to its remediation guide added a Preliminary Post Incident Review (PIR) that offers the vendor's view of how it brought down 8.5 million Windows boxes. The explanation opens by detailing that CrowdStrike's Falcon Sensor ships with "Sensor Content" that defines its capabilities. The software is updated with "Rapid Response Content" that allows it to detect and collect info on new threats. Sensor Content relies on "Template Types" - code that includes pre-defined fields for threat detection engineers to leverage in Rapid Response Content. Rapid Response Content is delivered as "Template Instances," which CrowdStrike describes as "instantiations of a given Template Type." Each Template Instance maps to specific behaviors for the sensor software to observe, detect or prevent.