When reviewing a Host Timeline, which of the following filters is available?
Answer(s): B
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Host Timeline tool allows you to view all events recorded by the sensor for a given host in a chronological order. The events include process executions, file writes, registry modifications,network connections, user logins, etc. You can use various filters to narrow down the events based on criteria such as event type, timestamp range, file name, registry key, network destination, etc. However, there is no filter for severity, user name, or detection ID, as these are not attributes of the events.
In the "Full Detection Details", which view will provide an exportable text listing of events like DNS requests. Registry Operations, and Network Operations?
Answer(s): D
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Full Detection Details tool allows you to view detailed information about a detection, such as detection ID, severity, tactic, technique, description, etc. You can also view the events generated by the processes involved in the detection in different ways, such as process tree, process timeline, or process activity. The process activity view provides a rows-and-columns style view of the events, such as DNS requests, registry operations, network operations, etc. You can also export this view to a CSV file for further analysis.
When examining a raw DNS request event, you see a field called ContextProcessld_decimal. What is the purpose of that field?
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the ContextProcessld_decimal field contains the decimal value of the process ID of the process that generated the event. This field can be used to trace the process lineage and identify malicious or suspicious activities. For a DNS request event, this field indicates which process made the DNS request.
You found a list of SHA256 hashes in an intelligence report and search for them using the Hash Execution Search. What can be determined from the results?
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Hash Execution Search tool allows you to search for one or more SHA256 hashes and view a summary of information from Falcon events that contain those hashes. The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, and geolocation of the host that loaded or executed those hashes. You can also see a count of detections and incidents related to those hashes.
What information is contained within a Process Timeline?
Answer(s): A
According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline tool allows you to view all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc. You can specify a timeframe to limit the events to a certain period. The tool works for any host platform, not just Mac or Linux.
Post your Comments and Discuss CrowdStrike CCFR-201 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CCFR-201 content, but please register or login to continue.