When creating new IOCs in IOC management, which of the following fields must be configured?

The correct answer is D. Hash, Platform and Action. When creating new IOCs in IOC management, the administrator must configure the Hash, Platform and Action fields. The Hash field is the value of the IOC, such as MD5, SHA1 or SHA256. The Platform field is the operating system that the IOC applies to, such as Windows, Linux or Mac.

IOC Management and Detection Tuning

Question

Options

AHash, Description, Filename
BHash, Action and Expiry Date
CFilename, Severity and Expiry Date
DHash, Platform and Action

How the community answered

(31 responses)

A
10% (3)
B
3% (1)
D
87% (27)

Explanation

When creating new IOCs in IOC management, the administrator must configure the Hash, Platform and Action fields. The Hash field is the value of the IOC, such as MD5, SHA1 or SHA256. The Platform field is the operating system that the IOC applies to, such as Windows, Linux or Mac. The Action field is the action that Falcon will take when detecting the IOC, such as Detect, Block or Allow. The other fields are either optional or not available.

Topics

#IOC management#required fields#indicators of compromise#platform configuration

Community Discussion

No community discussion yet for this question.

Full CCFA-200B Practice