Perform an Event Advanced Search from a Detection and Refine a Search Using Event Actions CCFR Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst is reviewing Event Advanced Search results and notices that the results are not matching the detection's context. The detection was for a file deletion, but the search results show file creation events. What is the most likely cause of this discrepancy?

   • AThe search time range is too narrow and is excluding the file deletion events.
   • BThe Advanced Search from the detection did not include a filter for the specific event type (file deletion).
   • CThe detection was a false positive and the search results are correct.
   • DThe search is showing events from a different host.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In Event Advanced Search, an analyst wants to narrow results to only events from a specific host. Which action should the analyst take?

   • AChange the time range to match the host's activity period.
   • BSort the results by the 'Hostname' column in ascending order.
   • CUse the 'Group by' option to group events by hostname.
   • DAdd a filter for 'Hostname' and set the condition to 'equals' with the desired hostname.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A responder is reviewing Event Advanced Search results for a detection and notices that the events are dominated by a single benign application that runs every minute. The responder wants to see the less frequent, potentially malicious events that are being buried. Which approach best addresses this?

   • ASort the results by timestamp in descending order to see the most recent events first.
   • BChange the search time range to a longer period to capture more events.
   • CUse the 'Exclude' action on the benign application's events to remove them from the results.
   • DSwitch to a different event type that does not include the benign application.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A responder is investigating a detection and has pivoted to an Event Advanced Search. The initial results show a large number of events, and the responder wants to identify the most relevant events quickly. The responder has a hypothesis that the malicious activity involved a specific script. Which approach best tests this hypothesis?

   • AAdd a filter for the script name or path and review the matching events.
   • BUse 'Exclude' on all events that do not involve the script.
   • CExport all events to a CSV and search for the script name in the file.
   • DSort the results by timestamp and review the most recent events.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A responder is investigating a detection and has pivoted to an Event Advanced Search. The responder has identified a specific event that is the key to the investigation. The responder wants to see all events that occurred immediately before and after this event on the same host. What is the best approach?

   • ASort the results by timestamp and manually scroll to the key event.
   • BUse 'Add to Search' on the event ID of the key event.
   • CAdd a filter for the hostname and adjust the time range to a few minutes before and after the key event's timestamp.
   • DUse 'Exclude' on all other events to isolate the key event.
   Reveal Solution Discussion Select an answer first