CCFH-202B: CrowdStrike Certified Falcon Hunter

By CrowdStrike · Question Mode

QuestionQ78

VerifiedEvent Search

You suspect that a user is misusing their administrator privileges and want to view the recent commands they have been using.

Which Investigate search identifies this?

Explanation

User Search associates endpoint activity with a specified user account, allowing recent command and process activity performed under that user’s administrative identity to be identified.

Community Discussion

No comments yet. Be the first to start the discussion!