CCSE: CrowdStrike Certified SIEM Engineer

By CrowdStrike · Question Mode

QuestionQ54

VerifiedIncident Workbench and SIEM Alerts

Following the principle of least privilege, which role should be assigned to a Falcon Next-Gen SIEM user who needs permission to read case data and write XDR data, but must not be allowed to write case templates?

Explanation

The NG SIEM Analyst role supplies the operational access needed to investigate case data and update XDR data without granting case-template write privileges. It therefore meets the stated access requirements with less privilege than Security Lead or NGSIEM Administrator roles.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!