CCFA-200B: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ34

VerifiedRules Configuration

Your development team is building a new enterprise application, but Falcon begins generating alerts during testing. The alert identifies C:\Users\Bob\DevCode\felix.dll. The detection shows that it triggers only on one specific Falcon IOA.

What is the best course of action in this situation?

Explanation

A Falcon IOA exclusion can suppress a known benign file path for the particular IOA that is generating the alert. This narrowly addresses the development-testing false positive without disabling the built-in IOA for other files or detections.

Community Discussion

No comments yet. Be the first to start the discussion!