CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ2

VerifiedEvent Search

You are investigating several NetworkConnectIP4 events, all with the same ContextProcessId of 123456789.

Which query will display the process responsible for these NetworkConnectIP4 events?

Explanation

For CrowdStrike network events, ContextProcessId correlates to TargetProcessId in ProcessRollup2 and SyntheticProcessRollup2 process events. Filtering those process events for TargetProcessId = 123456789 identifies the process responsible for the network connections.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!