CCFH-202B: CrowdStrike Certified Falcon Hunter

A device-containment operation produces an event when the containment change is requested and a corresponding event when the request reaches its completed status. Thus, three containment operations create six pending-containment events.

For CrowdStrike network events, ContextProcessId correlates to TargetProcessId in ProcessRollup2 and SyntheticProcessRollup2 process events. Filtering those process events for TargetProcessId = 123456789 identifies the process responsible for the network connections.

A broad hunt should search both ProcessRollup2 and SyntheticProcessRollup2 telemetry, match evil.exe case-insensitively, extract the final filename from the image path, and aggregate the results by host, path, and command-line details. This identifies occurrences across hosts without limiting the search to a single agent ID or a particular user-path pattern.

CrowdStrike Falcon custom dashboards can display Advanced Event Search output by creating a customized dashboard widget from the search query. A saved search, scheduled search, or scheduled workflow serves a different purpose and does not directly add the query results to a dashboard.

The NewScheduledTaskRegistered event identifies the registration of a new scheduled task, and UserName="Doris" restricts the results to tasks registered by Doris.