CCSE: CrowdStrike Certified SIEM Engineer

By CrowdStrike · Question Mode

QuestionQ53

VerifiedCorrelation Rules and Falcon Fusion SOAR

A correlation rule is generating a high volume of detections. You have been asked to temporarily deactivate it so that your team can investigate.

What will happen to previously generated detections while the rule is deactivated?

Explanation

Deactivating a correlation rule stops future searches and detection generation, but it does not change or remove detections that were already created. Existing detections therefore remain available in the console.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!