4.3 Format Event Data for User Readability, Export or Charting CCFH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A Falcon Hunter is working with a query that returns events containing a field `ProcessId` which is stored as a numeric value. The hunter wants to ensure this field is displayed with a leading zero (e.g., `00456`) in the results table for consistency with other documentation. Which formatting technique should the hunter apply?

   • AHide the field and manually add the leading zeros in a spreadsheet after export.
   • BUse a formatting function to convert the numeric field to a string and pad it with leading zeros.
   • CCreate an alias for the field with the same name but different casing.
   • DChange the field's data type in the query to a boolean.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A Falcon Hunter is analyzing a query that returns events with a `Severity` field that has values like `low`, `medium`, `high`, and `critical`. The hunter wants to create a chart that displays the events in a meaningful order from most to least severe, rather than alphabetical order. The hunter also wants to ensure the chart's legend is easy to read. Which approach should the hunter take?

   • AUse a function in the query to map the severity values to numeric scores (e.g., low=1, medium=2, high=3, critical=4) and then create a chart based on this numeric field.
   • BHide the `Severity` field and create a chart based on the `EventType` field instead.
   • CCreate a chart using the raw `Severity` field and rely on the charting tool's default alphabetical sorting.
   • DExport the data to CSV and manually reorder the rows in a spreadsheet before creating a chart.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following file formats is commonly available when exporting event data from CrowdStrike Falcon Event Search for use in external reporting tools?

   • ACSV
   • BDOCX
   • CXLSX
   • DPDF
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A Falcon Hunter is investigating a potential insider threat. The hunter has a query that returns a large volume of file access events. The hunter needs to identify users who have accessed an unusually high number of unique files compared to their peers. The hunter also needs to present the findings to a non-technical HR manager. The HR manager wants to see a clear visual of the top offenders and a simple list of the specific files each user accessed. Which approach best meets the needs of both the hunter and the HR manager?

   • AHide the user field in the query results and only show the file names to the HR manager.
   • BCreate a pie chart showing the proportion of file accesses by user and present it to the HR manager.
   • CCreate a bar chart showing the count of unique files accessed per user, and export a CSV with the user and file details for the top users.
   • DExport the full event data as JSON and provide it to the HR manager without any analysis.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A Falcon Hunter needs to provide a list of all unique IP addresses that have been flagged for a particular alert to a firewall administrator. The administrator needs a simple, plain-text list of these IPs to add to a blocklist. The hunter has a query that returns all events with the flagged IPs. What is the most appropriate way to produce this deliverable?

   • AExport the full event data as JSON and let the administrator parse out the IPs.
   • BRun a query that deduplicates the IP addresses and export the results as a CSV file.
   • CCopy the IP addresses from the UI and paste them into an email.
   • DCreate a pie chart of the IP addresses and export it as an image.
   Reveal Solution Discussion Select an answer first