5.3 Leverage the Events Reference (Events Data Dictionary) Documentation to Learn Information About Specific Events CCFH Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   When reviewing the Events Reference for a network event, an analyst sees the field 'LocalPort' listed. What data type and meaning would the analyst expect for this field?

   • AA boolean indicating whether the port is open or closed.
   • BA string representing the port number, such as '443'.
   • CAn integer representing the local port number used in the network connection.
   • DA timestamp indicating when the port was last used.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A Falcon Hunter is investigating a suspicious PowerShell command and sees an event named 'ProcessRollup2' in the Event Search. They want to read the official documentation for this event. What is the most efficient way to find it in the Events Reference?

   • ASearch the Falcon community forums for 'ProcessRollup2'.
   • BUse the search function in the Events Reference and type 'ProcessRollup2'.
   • CReview the raw event JSON to understand its structure.
   • DBrowse through all events alphabetically until they reach 'P'.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   While hunting, an analyst sees an event type 'SuspiciousDNSRequest' in the Event Viewer. The analyst is unfamiliar with this event. What is the first step the analyst should take to understand and respond to this event?

   • ALook up 'SuspiciousDNSRequest' in the Events Reference to learn what the event indicates and what fields are available.
   • BDelete the event from the Event Viewer to reduce noise.
   • CImmediately block the domain associated with the event in the Falcon console.
   • DContact CrowdStrike support to ask what the event means.
   Reveal Solution Discussion Select an answer first
5. 19expert · medium

   A Falcon Hunter is writing a custom detection rule and needs to filter on a field that indicates the parent process ID. They are unsure of the exact field name. They have access to the Events Reference. What is the best way to find the correct field name?

   • ASearch the Events Reference for the event type they are interested in and look for a field with 'Parent' in the name.
   • BReview the raw event data to see the field names.
   • CAsk a colleague for the field name.
   • DUse the Falcon API to list all available fields.
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A Falcon Hunter is investigating an incident and needs to understand a specific event that is not well-known. They have access to the Falcon console but are not sure if the Events Reference is available to them. What is the best way to determine if they can access it?

   • AContact CrowdStrike support to request access.
   • BNavigate to the Documentation section in the Falcon console and look for the Events Reference.
   • CCheck their user role permissions in the Falcon console.
   • DSearch the CrowdStrike community forums for the event.
   Reveal Solution Discussion Select an answer first