CCFA-200B: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ24

VerifiedDashboards and Reports

Which log would you use to investigate unusual activity involving a script that interacts with the Falcon platform?

Explanation

API audit logs capture activity performed through the Falcon API, including actions initiated by scripts and other programmatic integrations. CrowdStrike’s Event Streams add-on guidance specifically directs users to validate a connection to Falcon by using the API Audit log.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!