CCFA: CrowdStrike Certified Falcon Administrator

Question

You have identified numerous Machine Learning detections in your environment as false positives. They are caused by one binary custom-written for you by a vendor, and that binary runs on many endpoints. What is the best way to prevent this in the future?

Explanation

A custom IOC for the binary’s hash with the Allow action allowlists that approved file across the applicable endpoints, preventing Machine Learning detections for that exact binary. CrowdStrike’s IOC documentation explicitly supports SHA256 hash indicators with an allow action and gives an approved-application allowlist as an example.

Learn more

CrowdStrike Developer Center — custom_ioc

CCFA: CrowdStrike Certified Falcon Administrator

AstroTutor

Notes

Readiness

QuestionQ245

Community Discussion