CCSE: CrowdStrike Certified SIEM Engineer

By CrowdStrike · Question Mode

QuestionQ8

VerifiedIncident Workbench and SIEM Alerts

An internal security team has identified a small set of high-risk users. They ask you to build an app that monitors these users and triggers an alert when specified suspicious behavior is detected.

Which Falcon feature should you use to build this app?

Explanation

Falcon Foundry is CrowdStrike’s application-development platform for building custom Falcon apps with automated workflows, queries, and integrations. Those capabilities can monitor defined user activity and trigger alerts when suspicious-event conditions are met.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!