Perform an Event Advanced Search from a Detection and Refine a Search Using Event Actions CCFR Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A Falcon Responder is investigating a detection on a domain controller. The detection details show a suspicious process, but the responder needs to determine if the process communicated with any external IP addresses. The responder pivots to an Event Advanced Search from the detection. What is the most effective way to identify external network communications?

   • AFilter for network events involving the process, then review the destination IPs and compare them against known internal IP ranges.
   • BFilter for all network events on the host and look for any IP that is not the host's own IP.
   • CExport all events from the host to a CSV and analyze the data in a spreadsheet.
   • DUse the 'Add to Search' action on the process name and then filter for network events.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   An analyst is viewing a detection and wants to start an Event Advanced Search that includes the detection's associated process and network events. What is the most direct way to accomplish this?

   • AClick the 'Advanced Search' icon on the detection details page to launch a search with relevant filters pre-applied.
   • BExport the detection report and import it into a third-party SIEM tool.
   • COpen the 'Event Search' tab and select the detection's timestamp manually.
   • DCopy the detection's ID and paste it into the global search bar on the Falcon dashboard.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   While reviewing a detection in Falcon, an analyst wants to pivot into the underlying event data to investigate further. Which action should the analyst take directly from the detection's details?

   • AUse the 'Falcon Fusion' workflow to create a new trigger for event data.
   • BClick 'View in Event Search' to open an Advanced Search pre-populated with the detection's context.
   • CNavigate to the 'Investigate' tab and manually type the detection's ID into the search bar.
   • DOpen the 'Hosts' page and select the host to view its event timeline.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   After running an Event Advanced Search, an analyst sees a large number of results but notices that many are from a known benign application. What should the analyst do to focus on potentially malicious activity?

   • AAdd a filter to exclude the benign application's process name.
   • BIgnore the results and start a new search from scratch.
   • CChange the time range to a shorter window.
   • DExport all results to a CSV file for manual review.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A detection is triggered on a workstation, and the Falcon Responder needs to investigate the parent process of the detected process. The detection details show the child process but not the parent. What is the most efficient way to find the parent process information?

   • AUse the detection's 'View in Graph' feature to see the parent process visually.
   • BRun a new search for all events on the host and look for the parent process manually.
   • CInitiate an Advanced Search from the detection and filter for ProcessRollup2 events involving the detected process to see its parent.
   • DCheck the host's process list in the Host Management page.
   Reveal Solution Discussion Select an answer first