CCIS: CrowdStrike Certified Identity Specialist

Adding the related user and endpoint to a watchlist enables ongoing monitoring of those entities after endpoint detections matching the specified technique condition occur. Network containment, host-group assignment, and marking entities are different response or organizational actions rather than the mechanism for monitoring both associated entities.