QuestionQ63Verified/Sensor DeploymentCopy linkReport a problemAsk AstroTutorSave questionWhat occurs when a Falcon Sensor on a Linux host enters Reduced Functionality Mode (RFM)?ARFM sensors on Linux hosts stop processing both events and detections. Sensors send basic status information to the Falcon Console.BRFM sensors on Linux hosts stop processing events and detections but continue to send log data into Falcon.CRFM sensors on Linux hosts continue to process events and detections for existing policies but cannot get policy updates from the Falcon Console.DRFM sensors on Linux hosts only send detection information to the Falcon Console. Event processing is disabled.Show AnswerAnswerExplanationA Linux Falcon sensor in Reduced Functionality Mode does not process events or generate detections. It continues sending basic heartbeat or status information to Falcon so the console can indicate that the sensor remains installed on the host.Show comments0Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion