Perform an Event Advanced Search from a Detection and Refine a Search Using Event Actions CCFR Practice Questions (Page 4)

Questions 16–18

1. 16foundation · easy

   An analyst runs an Event Advanced Search and receives zero results. Which interpretation is most appropriate?

   • AThere is a problem with the Falcon platform itself.
   • BThe search criteria may be too restrictive; consider broadening filters or time range.
   • CThe event data is definitely not present in Falcon.
   • DThe search is complete and no further investigation is needed.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   An analyst has an Advanced Search that returns too many events. Which action would effectively reduce the number of results?

   • AAdd a filter to include only events with a specific event type.
   • BChange the sort order to show the newest events first.
   • CIncrease the time range to include more events.
   • DRemove all existing filters to broaden the search.
   Reveal Solution Discussion Select an answer first
3. 18application · medium

   A Falcon Responder is investigating a detection triggered by a suspicious PowerShell process on a single host. The detection details show the process tree and command line, but the responder needs to see all network connections made by that specific process instance in the 5 minutes before the detection fired. What is the most direct way to pivot into this data?

   • ANavigate to the Event Search module and manually type a query for all network events on the host's IP address.
   • BUse the detection's 'View in Graph' option to visualize the process and then export the graph as a CSV of network events.
   • COpen the detection, select the process, and choose 'Advanced Search' to launch an Event Search pre-filtered to that process on that host.
   • DOpen the host's process timeline and filter by the process name to see all historical executions of that binary.
   Reveal Solution Discussion Select an answer first