CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ72

VerifiedEvent Search

You are looking for every event associated with a particular process.

Which fields should you choose in a query from the field drop-down menu?

Explanation

TargetProcessId identifies the process in its process-record event, and ContextProcessId links subsequent activity events back to that process. Selecting both fields retrieves the process record and the events associated with it.

Community Discussion

No comments yet. Be the first to start the discussion!