CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ51

VerifiedEvent Search

While reviewing network activity, an increase in DNS requests is observed for a newly registered domain with a poor reputation.

What is an appropriate first action to investigate this potential threat?

Explanation

Falcon Investigate can search DNS-request telemetry to identify all hosts that queried the domain and provide the scope needed for informed triage and response. Establishing affected endpoints and related activity precedes containment or blocking decisions.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!