CCFA: CrowdStrike Certified Falcon Administrator

Question

The organization has determined that its cybersecurity architect must receive an email whenever Falcon generates detections with a severity of medium or higher. In addition, the architect must be notified of any incidents with a CrowdScore of 1.0 or higher.

What can the Falcon Administrator do to ensure the architect is alerted appropriately?

Explanation

Falcon’s General settings include a managed recipient list for detection and incident emails. Adding the architect’s email address to that list delivers the native notifications for medium-or-higher detections and incidents with a CrowdScore of 1.0 or higher; Falcon user roles do not automatically enroll a person in these emails.

CCFA: CrowdStrike Certified Falcon Administrator

AstroTutor

Notes

Readiness

QuestionQ248

Community Discussion