QuestionQ34
Rules ConfigurationYour development team is building a new enterprise application, but Falcon begins generating alerts during testing. The alert identifies C:\Users\Bob\DevCode\felix.dll. The detection shows that it triggers only on one specific Falcon IOA.
What is the best course of action in this situation?
- A Create an IOA exclusion for “C:\Users\Bob\DevCode\felix.dll”
- B Create a Custom IOC and set it to “Allow” for “C:\Users\Bob\DevCode\felix.dll”
- C Manually turn off the built-in IOA through prevention policies
- D Create a sensor visibility exclusion for “C:\Users\Bob\DevCode\felix.dll”
Community Discussion