Which of the following best practices should you follow when creating custom IOM rules in CrowdStrike Falcon to prevent accidental disruptions in operations?

Question

Options

• AUse the "Regex" condition type to cover all possible indicators with a single rule.
• BDisable logging for custom rules to reduce performance overhead.
• CApply the rule to all systems in the organization without exclusions.
• DTest the rule in a Detection-only mode before enabling blocking.

• A
  9% (5)
• B
  4% (2)
• C
  5% (3)
• D
  82% (46)

Explanation

Option A: This is incorrect because while Regex can be powerful, overly broad patterns may result in false positives or system disruptions. It is better to create specific rules tailored to precise Option B: This is incorrect because logging is crucial for monitoring the effectiveness of IOM rules and troubleshooting issues. Disabling logs would make it difficult to audit the rule's impact and Option C: This is incorrect because applying a rule universally can lead to unintended consequences, especially if critical systems or services rely on the flagged entity. You should define exclusions for known benign use cases. Option D: This is correct because testing in Detection-only mode allows you to monitor the rule's effectiveness and ensure it does not cause unintended disruptions before enabling the "Block" action. This approach minimizes risks associated with false positives.

No community discussion yet for this question.