CCFA-200B: CrowdStrike Certified Falcon AdministratorDemo

By CrowdStrike · Question Mode

QuestionQ24

Dashboards and Reports

Which log would you use to investigate unusual activity involving a script that interacts with the Falcon platform?

  • A API audit
  • B Falcon UI audit
  • C Prevention policy debug
  • D RTR session audit
Explanation

API audit logs capture activity performed through the Falcon API, including actions initiated by scripts and other programmatic integrations. CrowdStrike’s Event Streams add-on guidance specifically directs users to validate a connection to Falcon by using the API Audit log.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!