When using the Identity Analyzer feature in CrowdStrike CIEM to identify inactive users, which data source is primarily used to assess inactivity?

Question

Options

• ANetwork traffic logs from connected endpoints.
• BHistorical security alerts from CrowdStrike Falcon.
• CCrowdStrike Falcon sensor telemetry.
• DAudit trails of API calls and resource utilization.

• A
  4% (2)
• B
  6% (3)
• C
  2% (1)
• D
  88% (42)

Explanation

Option A: Network traffic logs are related to endpoint or network-level activity, not specific to cloud identities or IAM behavior. CIEM focuses on cloud-specific activity data like API calls and resource usage, making this an irrelevant data source. Option B: Security alerts focus on threats and anomalies, not routine user activity patterns. CIEM uses operational data like API calls and resource usage to assess inactivity, which makes security alerts irrelevant for this purpose. Option C: Falcon sensor telemetry is used for endpoint detection and response, not cloud IAM activity. While it complements CIEM for overall security, it does not directly contribute to inactivity Option D: CIEM's Identity Analyzer uses audit trails, including API call records and resource utilization data, to detect inactivity. This ensures a holistic understanding of user behavior and accurately identifies users who no longer engage with cloud resources. This approach reduces false positives and enhances the security posture by identifying legitimate inactive accounts.

No community discussion yet for this question.