CCFA-200B: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ13

VerifiedPolicy Application

Your organization has concluded that its cybersecurity architect must receive an email whenever Falcon generates detections with medium severity or higher. In addition, the architect must be notified of any incidents with a CrowdScore of 1.0 or higher.

What can the Falcon Administrator do to ensure the architect receives the appropriate alerts?

Explanation

Falcon’s General settings include managed recipient lists for detection and incident email notifications. Adding the architect’s email address there allows the configured detection-severity and incident-CrowdScore thresholds to send the required alerts.

Community Discussion

No comments yet. Be the first to start the discussion!