CCFA: CrowdStrike Certified Falcon Administrator

Question

The security team observes that certain privacy-sensitive information, such as the URL, HTTP Header, and POST bodies, is absent from HTTP-related detections.

What is the likely cause?

Explanation

A Falcon prevention-policy setting can redact HTTP detection details, removing the URL, raw HTTP headers, and POST bodies from detection events to limit exposure of potentially sensitive information. It does not prevent HTTP detections from being generated.

Learn more

CrowdStrike Developer Center — Default Prevention Policy for Windows

CCFA: CrowdStrike Certified Falcon Administrator

AstroTutor

Notes

Readiness

QuestionQ141

Community Discussion