CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ35

VerifiedEvent Search

Your team has just received a detection about a potentially malicious binary running on an endpoint. Using CQL, you want to identify all events related to that detection.

Which field is used to correlate events with this detection?

Explanation

TreeId is the identifier for the process tree associated with a detection, so it correlates the events belonging to that detection’s process tree.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!