CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ11

VerifiedDashboards and Reports

You have been asked to troubleshoot why Script Based Execution Monitoring (SBEM) is not enabled on a Falcon host. Which report can be used to determine whether an old prevention policy is causing the issue?

Explanation

The Prevention Policy Debug report identifies the prevention-policy configuration and version applied to a host, allowing administrators to determine whether SBEM is absent because the host is using an outdated prevention policy.

Community Discussion

No comments yet. Be the first to start the discussion!