CCFA: CrowdStrike Certified Falcon Administrator

By CrowdStrike · Question Mode

QuestionQ87

VerifiedRule Configuration

Leadership requires controls that enable immediate action for any OverWatch detections.

What should you do to ensure the host is quickly contained and the appropriate staff are notified?

Explanation

A Fusion SOAR workflow using the OverWatch playbook can automatically contain the affected host and send an email notification to the SOC team, providing both immediate containment and notification of the appropriate responders.

Community Discussion

No comments yet. Be the first to start the discussion!