CCSE: CrowdStrike Certified SIEM Engineer

The default third-party connector system alerts cover a connector receiving no data for 24 hours, a connector becoming disconnected, and automatically resolving alerts within 30 days. Data-ingestion-limit alerts are not enabled by default.

A CrowdStrike CID can have up to 750 active correlation rules, with scheduled searches included in that active-rule limit.

JSON and key-value records require different parsing rules. A multi-source configuration supports assigning an appropriate parser to each source or format, so both types of incoming logs can be interpreted correctly.

Falcon Log Collector requires a 1 GB baseline in addition to the memory queues configured for its sinks. Four 2 GB memory queues consume 8 GB, so the minimum required memory is 9 GB.

A custom parser should apply the appropriate timezone parameter when parsing the log timestamp, so the event time is interpreted correctly. Cloning the parser allows that timezone-specific change while retaining the original parser. Google Security Operations supports a timezone parameter in its date parsing function.