CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ230

VerifiedRule Configuration

A significant number of false-positive detections affecting your developers are being blocked and quarantined by Falcon.

Which Indicator of Compromise (IOC) action is the best option?

Explanation

The Allow IOC action allowlists the approved indicator, preventing Falcon from blocking or quarantining it. CrowdStrike documents allow as a custom IOC action and uses it for an approved-application allowlist.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!