CCFA-200B: CrowdStrike Certified Falcon Administrator

Question

You will test detections on your host using pentest and security tooling.

How can you create a workflow that automatically assigns to you, in real time, any detection associated with your pentest?

Explanation

An Event-triggered EPP-detection workflow can be scoped with a hostname condition so that it applies only to detections from the pentest host. This prevents unrelated EPP detections from being assigned to the tester; the matching workflow can assign those scoped detections to that user.

CCFA-200B: CrowdStrike Certified Falcon Administrator

AstroTutor

Notes

Readiness

QuestionQ5

Community Discussion