5.3 Leverage the Events Reference (Events Data Dictionary) Documentation to Learn Information About Specific Events CCFH Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A Falcon Hunter is writing a custom query to detect unusual outbound connections. They want to filter on a field that indicates the destination IP address. They are unsure of the exact field name. How can the Events Reference help them?

   • ABy showing them the network traffic captured for a specific host.
   • BBy providing the list of all possible IP addresses seen in the environment.
   • CBy providing the exact field names and descriptions for network-related events.
   • DBy generating a sample query for them to use.
   Reveal Solution Discussion Select an answer first
2. 12expert · medium

   A Falcon Hunter is analyzing an event and sees a field 'TargetFileName' that contains a path. They want to know if this path is the full path or just the file name. They have the Events Reference open. What is the best way to determine this?

   • ALook at the raw event data to see the exact value.
   • BCheck the host's file system to see if the path exists.
   • CRead the field description in the Events Reference for that event.
   • DRun a search for other events with the same field to see patterns.
   Reveal Solution Discussion Select an answer first
4. 13expert · medium

   A Falcon Hunter is investigating a detection that involves multiple events. They see an event with an ID of 1007 and another with an ID of 1008. They need to understand the relationship between these events to determine the attack chain. They have access to the Events Reference. What is the most effective approach?

   • ALook up both events in the Events Reference and compare their descriptions and fields.
   • BRun a new search for all events with the same process ID to see the sequence.
   • CSearch the internet for the event IDs to find community discussions.
   • DReview the detection's narrative to understand the attack chain.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A Falcon Hunter is reading an event in the Event Search and sees a field named 'CommandLine' with a long string. They want to know if this field is truncated or contains the full command line. What is the best way to determine this?

   • ALook at the raw event JSON to see if the value ends with an ellipsis.
   • BCheck the Events Reference for the event to see if the field has a maximum length noted.
   • CAsk the host's administrator to check the process command line.
   • DRun the command in a sandbox to see the full output.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A Falcon Hunter is analyzing a series of events around a potential credential theft. They notice an event with a field 'LogonType' and want to understand if a particular value indicates a network logon. Using the Events Reference, what is the best way to determine this?

   • AReview the raw event JSON to see the exact value.
   • BRun a new search for all events with the same LogonType value to see patterns.
   • CCheck the Falcon documentation for Windows logon events.
   • DLook up the event in the Events Reference and read the description of the LogonType field.
   Reveal Solution Discussion Select an answer first