CCFA-200B: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ11

VerifiedRules Configuration

Detections associated with a penetration test on a particular server are currently producing thousands of entries in the console. Leadership does not need to monitor these detections in Falcon.

What should you do so the team can focus on more relevant detections?

Explanation

A Sensor Visibility Exclusion (SVE) suppresses the unwanted detection visibility from authorized penetration-testing activity on the scoped host, reducing console noise while allowing the team to concentrate on relevant detections.

Community Discussion

No comments yet. Be the first to start the discussion!