QuestionQ34

Rules Configuration

Your development team is building a new enterprise application, but Falcon begins generating alerts during testing. The alert identifies C:\Users\Bob\DevCode\felix.dll. The detection shows that it triggers only on one specific Falcon IOA.

What is the best course of action in this situation?

  • A Create an IOA exclusion for “C:\Users\Bob\DevCode\felix.dll”
  • B Create a Custom IOC and set it to “Allow” for “C:\Users\Bob\DevCode\felix.dll”
  • C Manually turn off the built-in IOA through prevention policies
  • D Create a sensor visibility exclusion for “C:\Users\Bob\DevCode\felix.dll”
Explanation

A Falcon IOA exclusion can suppress a known benign file path for the particular IOA that is generating the alert. This narrowly addresses the development-testing false positive without disabling the built-in IOA for other files or detections.

Community Discussion

No comments yet. Be the first to start the discussion!