3.2 Differentiate Use of Investigate Module Tools Available in Falcon CCFH Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   During an investigation, an analyst is looking at a detection that involves multiple hosts and a shared file. The analyst wants to see how the file was propagated across the hosts and identify any other entities that interacted with the file. The analyst also needs to determine if there is a common source for the file. Which Investigate module tool would be most effective for this analysis?

   • AUse the search bar to query for the file name and review all events involving that file.
   • BOpen the detection details and review the event timeline for each host.
   • CUse the graph view to visualize the file and its connections to hosts and users.
   • DNavigate to the host entity page for each host and review the file's presence.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following data types can be queried using the Falcon Investigate search bar?

   • AEvents, detections, and other indexed data such as hosts and users
   • BOnly detections generated by Falcon's machine learning
   • CEvents and detections only
   • DOnly events from the last 24 hours
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An analyst is investigating a user who has been flagged for unusual activity. The analyst wants to see all hosts the user has logged into, the files they have accessed, and any detections associated with the user. The analyst also wants to see if any of these hosts have communicated with known malicious IPs. Which Investigate module feature should the analyst use to get a comprehensive view?

   • AUse the graph view to visualize the user and expand all connections.
   • BUse the search bar to query for the user name and review all events involving the user.
   • CCreate a saved search for the user and run it across all hosts.
   • DNavigate to the user entity page and review the related hosts, files, and detections.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In Falcon Investigate, what is the purpose of applying a filter to a search?

   • ATo permanently delete unwanted events from the Falcon platform
   • BTo change the detection severity ratings assigned by Falcon
   • CTo export the search results to an external SIEM
   • DTo narrow down search results based on specific criteria such as host, user, or time range
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How can a Falcon analyst share a saved search with other team members?

   • ABy copying the search results to the clipboard
   • BBy sending the search query via email to each team member
   • CBy making the saved search available to the team through the Falcon console
   • DBy exporting the search results to a CSV file
   Reveal Solution Discussion Select an answer first