QuestionQ222Verified/Rule ConfigurationCopy linkReport a problemAsk AstroTutorSave questionUnder what circumstance would the No Action option be assigned to a hash in IOC Management?AWhen you want to save the indicator for later action, but do not want to block or allow it at this timeBAdd the indicator to your allowlist and do not detect itCThere is no such option as No Action available in the Falcon consoleDAdd the indicator to your blocklist and show it as a detectionShow AnswerAnswerExplanationThe No Action setting retains a hash indicator in IOC Management without allowing it, blocking it, or generating a detection. It is appropriate when the indicator should be preserved for later action but requires no current enforcement.Show comments1Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion