CCIS: CrowdStrike Certified Identity Specialist

By CrowdStrike · Question Mode

QuestionQ111

VerifiedThreat Hunting and Investigation

While triaging an identity detection, you determine that additional historical data is needed to assess the detection’s legitimacy. Which two information sources could be available?

Explanation

User Login History provides historical authentication behavior for the identity, while Threat Hunter events provide historical security-event context. Together, they support validation of whether the detected identity activity is consistent with prior legitimate behavior or indicates suspicious activity.

Community Discussion

No comments yet. Be the first to start the discussion!