QuestionQ53
Correlation Rules and Falcon Fusion SOARA correlation rule is generating a high volume of detections. You have been asked to temporarily deactivate it so that your team can investigate.
What will happen to previously generated detections while the rule is deactivated?
- A They will not be impacted and will remain within the console
- B Their status will change to closed and tagged as true positives in the console
- C Their status will change to closed and tagged as false positives in the console
- D They will be immediately deleted from the console
Community Discussion