CCFA-200BDemo

The Machine-Learning Prevention Monitoring Audit Log shows malicious processes that would have been blocked in the environment under different Machine-Learning Prevention settings. It supports evaluating the effect of prevention sensitivity without relying only on processes actually quarantined or blocked.

A client ID uniquely identifies the API client, while the client secret is the confidential credential used to authenticate and validate that client.

Manual Falcon Sensor installation on macOS requires allowing its system extension, granting Full Disk Access, and approving its network filter extension so the sensor can operate with the required endpoint visibility and network functionality.

An Event-triggered EPP-detection workflow can be scoped with a hostname condition so that it applies only to detections from the pentest host. This prevents unrelated EPP detections from being assigned to the tester; the matching workflow can assign those scoped detections to that user.

A workflow condition is a comparison rule composed of a parameter (the field being evaluated), an operator that defines the comparison, and a value to compare against. Fortinet documentation likewise describes condition construction by selecting a field, selecting an operator, and specifying a value.

CrowdStrike Falcon’s three-phase prevention-policy model designates Phase 3 as optimal protection, following initial deployment in Phase 1 and interim protection in Phase 2.

Falcon’s file-quarantine behavior is enabled through the applicable Prevention policy settings, where prevention actions for detected malicious files are configured.

Falcon user accounts must use an email address from the tenant’s approved-domain list. User roles are assigned independently, and an employee ID or domain identifier-and-number format is not the required account identity.

CIDR notation identifies an IP network by pairing an IP address with its network prefix length, such as /24.

A Sensor Visibility Exclusion (SVE) suppresses the unwanted detection visibility from authorized penetration-testing activity on the scoped host, reducing console noise while allowing the team to concentrate on relevant detections.

Windows sensors in Reduced Functionality Mode do not provide complete visibility into every event occurring on the host.

Falcon’s General settings include managed recipient lists for detection and incident email notifications. Adding the architect’s email address there allows the configured detection-severity and incident-CrowdScore thresholds to send the required alerts.

The Customer ID+ Checksum (CIDC) is used during Falcon Sensor installation to associate the new endpoint with the correct Falcon customer environment. It is not required for locating hosts, defining host-group assignment criteria, or standard sensor removal.

Falcon prevention policies are assigned through host groups. A host that is not a member of a host group associated with the custom prevention policy remains assigned to the default prevention policy, even when its sensor is functioning and the custom policy is successfully applied to other hosts.

In CrowdStrike Falcon Host Management, enter the hostnames as a comma-separated list in the Hostname filter to search for multiple hosts at once.

A dynamic host group with an assignment rule that filters for the Organizational Unit automatically includes current and future hosts that belong to that OU. This scopes the previously identified exclusion to the intended hosts as membership changes.

For a manually initiated Falcon Sensor installation on Windows, the installer runs in the interactive user context and writes installation log data to that user’s Local AppData Temp directory: %LOCALAPPDATA%\Temp.

Sensor Update policies are operating-system-specific. Windows, macOS, and Linux use separate policies so each platform’s sensor version and update settings can be managed independently.

The Type field identifies a sensor by the server role on which it is installed, including the Domain controller sensor type. Filtering by that field isolates Domain Controllers, whose installed sensor version can then be viewed.

The Endpoint Manager role has the endpoint-management permissions needed to manage quarantined files. Read-only analyst access and detection-exception management do not grant that capability.

Initiating a Real-Time Response session requires an assigned RTR role that grants the necessary RTR permissions. Without that role, the administrator is not authorized to start the session.

API audit logs capture activity performed through the Falcon API, including actions initiated by scripts and other programmatic integrations. CrowdStrike’s Event Streams add-on guidance specifically directs users to validate a connection to Falcon by using the API Audit log.

CrowdStrike Falcon’s Quarantine & Security Center Registration setting quarantines executable files after Next-Gen Antivirus (NGAV) prevents them. NGAV anti-malware prevention must also be enabled through the Next-Gen Antivirus Prevention sliders; CrowdStrike recommends a prevention level of Moderate or higher.

A Custom IOA rule can create a detection when a process is created and its executable path matches the regular expression for remote.exe. This provides detection-and-review monitoring without excluding the activity or relying on retrospective event searches.