CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ225

VerifiedRule Configuration

When creating a custom IOA for a particular domain, which syntax would be best for detecting or preventing activity on all subdomains too?

Explanation

.*\.baddomain\.xyz|baddomain\.xyz matches any hostname that has characters before .baddomain.xyz, covering subdomains, and separately matches the base domain baddomain.xyz. Escaping each period makes it a literal domain-label separator rather than a regex wildcard.

Community Discussion

No comments yet. Be the first to start the discussion!