What best describes what happens to detections in the console after clicking "Enable Detections" for a host which previously had its detections disabled?

Question

Options

• AEnables custom detections for the host
• BNew detections will start appearing in the console, and all retroactive stored detections will be
• CNew detections will start appearing in the console immediately. Previous detections will not be
• DPreventions will be enabled for the host

• A
  6% (2)
• B
  3% (1)
• C
  91% (32)

Explanation

The option that best describes what happens to detections in the console after clicking "Enable Detections" for a host which previously had its detections disabled is that new detections will start appearing in the console immediately. Previous detections will not be restored to the console for that host. The "Enable Detections" feature allows you to enable or disable the detection and prevention capabilities of the Falcon sensor on a specific host. When you disable detections for a host, the sensor will stop sending any detection or prevention events to the Falcon console, and any existing events for that host will be removed from the console. When you enable detections for a host, the sensor will resume sending any new detection or prevention events to the Falcon console, but any previous events for that host will not be restored to the console.

No community discussion yet for this question.