CrowdStrike Exam CCFH-202 Topic 8 Question 25 Discussion

Actual exam question for CrowdStrike's CCFH-202 exam

Question #: 25
Topic #: 8

You need details about key data fields and sensor events which you may expect to find from Hosts running the Falcon sensor. Which documentation should you access?

AEvents Data Dictionary

BStreaming API Event Dictionary

CHunting and Investigation

DEvent stream APIs

Show Suggested Answer

Suggested Answer: B

The Linux Sensor report is where an analyst would find information about shells spawned by root, Kernel Module loads, and wget/curl usage. The Linux Sensor report is a pre-defined report that provides a summary view of selected activities on Linux hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Linux hosts within a specified time range. The Sensor Health report, the Sensor Policy Daily report, and the Mac Sensor report do not provide the same information.

by Trinidad at Aug 05, 2024, 04:45 AM

Limited Time Offer

25%

24 days ago

I think we should access the Events Data Dictionary for details about key data fields and sensor events.

upvoted 0 times

...