CCFA: CrowdStrike Certified Falcon Administrator

Question

As a Falcon Administrator, you want to tune your Prevention Policies and compare the number of detections that would have occurred during the last 30 days for each detection level: Cautious, Moderate, Aggressive, or Extra Aggressive.

Which audit logs would best help you assess the appropriate setting to use?

Explanation

Machine-learning prevention monitoring provides historical counts of items that would have been detected or blocked under different machine-learning prevention levels. This enables comparison of Cautious, Moderate, Aggressive, and Extra Aggressive settings over the selected 30-day period when tuning a Prevention Policy.

CCFA: CrowdStrike Certified Falcon Administrator

AstroTutor

Notes

Readiness

QuestionQ133

Community Discussion