CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ175

VerifiedRule Configuration

Your development team is working on a new enterprise application, but Falcon begins generating alerts during testing. The alert references C:\Users\Bob\DevCode\felix.dll. The detection shows that it is triggering only on a specific Falcon IOA. What is the best course of action in this situation?

Explanation

An IOA exclusion is designed to suppress a known benign file or behavior from triggering a particular Falcon IOA while retaining the built-in IOA protection for other activity. This provides a targeted exception for the development DLL without broadly disabling the detection or reducing sensor visibility.

Community Discussion

No comments yet. Be the first to start the discussion!