CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ172

VerifiedWorkflows

You will test detections using pentest and security tools on your host.

How can you create a workflow that automatically assigns, in real time, any detection related to your pentest to yourself?

Explanation

An event-driven workflow runs when an EPP detection occurs. Restricting the trigger with a condition for the intended hostname ensures that only detections generated by the pentest host are matched, and an assignment action can route each matching detection to the specified user. Scheduled workflows do not provide real-time handling.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!