CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ47

VerifiedPolicy Application

Detections associated with a penetration test on a specific server are generating thousands of console entries. Leadership does not need to monitor these detections in Falcon.

What should you do so that the team can focus on more relevant detections?

Explanation

Falcon provides host-level detection suppression, including actions to suppress and later unsuppress detections. Temporarily disabling detections for the test server removes the authorized test noise from operational monitoring, while re-enabling them after testing restores normal visibility and avoids a lasting blind spot.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!