QuestionQ133Verified/Rules ConfigurationCopy linkReport a problemAsk AstroTutorSave questionHow can additional security controls be enforced for high-risk Real Time Response (RTR) commands?ACreate a Next-Gen SIEM rule that monitors for high-risk RTR commandsBDisable all high-risk RTR commands in your response policyCEnable MFA when users are performing critical actions within FalconShow AnswerAnswerExplanationFalcon can require multi-factor authentication for critical actions, adding an approval factor when a user performs high-risk Real Time Response commands. Monitoring does not prevent execution, while disabling commands is not an additional execution-time control.Show comments0Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion