CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ52

VerifiedSearch and Investigation Tools

You need to locate every execution of a file on older Windows operating systems. You also need to include the Windows OU and concentrate on OUs containing highly privileged systems and users.

Which query includes the file name, operating system, and OU?

Explanation

The match() function enriches events by matching an event field to a column in an uploaded lookup file. Matching aid against aid_master_main.csv and including Version and OU adds the operating-system version and organizational-unit context to the filtered ProcessRollup file-execution events.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!