CrowdStrike
CCFA-200B · Question #198
Your organization has determined that your cybersecurity architect needs to be notified via email whenever Falcon generates detections of a medium severity or higher. Additionally, the architect…
The correct answer is D. Create a custom Fusion SOAR workflow to send an email every time a new detection or incident. You've hit your limit · resets 12:50am (America/New_York)
Fusion SOAR Workflow Management
Question
Your organization has determined that your cybersecurity architect needs to be notified via email whenever Falcon generates detections of a medium severity or higher. Additionally, the architect should be notified about any incidents with a CrowdScore of 1.0 or higher. What can the Falcon Administrator do to ensure the architect is properly alerted?
Options
- ACreate a new Falcon user for the architect then create and assign a custom Falcon user role so
- BAdd the architect's email address to the manage list for detection and incident emails from the
- CCreate a new Falcon user for the architect and assign the Detections and Exceptions Manager
- DCreate a custom Fusion SOAR workflow to send an email every time a new detection or incident
How the community answered
(17 responses)- A6% (1)
- B12% (2)
- C6% (1)
- D76% (13)
Explanation
You've hit your limit · resets 12:50am (America/New_York)
Topics
#Fusion SOAR#detection notifications#incident alerts#CrowdScore
Community Discussion
No community discussion yet for this question.