QuestionQ39Verified/Rules ConfigurationCopy linkReport a problemAsk AstroTutorSave questionUnder what circumstances would the No Action option be assigned to a hash in IOC Management?AWhen you want to save the indicator for later action, but do not want to block or allow it at this timeBThere is no such option as No Action available in the Falcon consoleCWhen you want to add the indicator to your allowlist, but not detect itDWhen you want to add the indicator to your blocklist and show it as a detectionShow AnswerAnswerExplanationThe no_action custom-IOC action retains the hash indicator without allowing it, blocking it, or generating a detection. It is therefore appropriate when the indicator should be kept for future use but no action should currently be applied.Learn morecustom_ioc | CrowdStrike Developer CenterShow comments0Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion