As a Next-Gen SIEM Engineer, you are responsible for managing and tuning correlation rules to improve the detection of potential security incidents. One of your correlation rules is designed to detect multiple failed login attempts that are followed by a successful login within a short time frame.Which step would you take to tune this correlation rule to reduce false positives while maintaining its effectiveness?
Answer(s): B
Excluding trusted IP addresses helps reduce false positives caused by legitimate user activity while keeping the rule effective at detecting suspicious login patterns from unknown or untrusted sources.
Which statement is accurate about how data ingest is measured and represented in Next-Gen SIEM?
Answer(s): A
Next-Gen SIEM measures data ingest based on the average gigabytes per day from all data sources, calculated before parsing, to accurately represent the volume of raw log data entering the system.
Following the principle of least privilege, which is the appropriate role to grant a Falcon Next-Gen SIEM user the permissions to read case data and write XDR data while denying the permission to write case templates?
Answer(s): C
The NG SIEM Analyst role allows reading case data and writing XDR data while restricting administrative actions such as modifying or writing case templates, aligning with the principle of least privilege.
You need to ingest data from a custom internal application hosted on-prem. The application writes logs to a file on a syslog server.Which data connector would you use?
The HTTP Event Connector is used to ingest log data from custom applications, including on-premises sources that can forward logs (such as via a syslog server) over HTTP, enabling integration with Falcon Next- Gen SIEM.
You find a Falcon Log Collector instance on a Linux system that is not connected to Fleet Management.What command would you use to enroll the Falcon Log Collector?
On Linux systems, the humio-log-collector enroll <TOKEN> command is used to enroll a Falcon Log Collector into Fleet Management, allowing it to start reporting and receiving configurations.
Post your Comments and Discuss CrowdStrike CCSE exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CCSE content, but please register or login to continue.