CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ42

VerifiedRule Configuration

Management has prohibited 100 hashes that must be blocked across your organization.

Using Falcon, what is the best way to accomplish this?

Explanation

Falcon blocks known file hashes by creating custom IOCs in IOC Management with the action set to Block. The applicable prevention policy must have Custom Blocking enabled under Execution Blocking so endpoints enforce those custom IOC blocks.

Community Discussion

No comments yet. Be the first to start the discussion!