When a Linux host is in Reduced Functionality Mode (RFM) what telemetry and protection is still offered?

Question

Options

• AThe sensor would provide protection as normal, without event telemetry
• BThe sensor would provide minimal protection
• CThe sensor would function as normal
• DThe sensor provides no protection, and only collects Sensor Heart Beat events

• A
  7% (2)
• B
  89% (25)
• C
  4% (1)

Explanation

When a Linux host is in Reduced Functionality Mode (RFM), the sensor would provide minimal protection. RFM is a mode that limits the sensor's functionality due to license expiration, network connectivity loss, or certificate validation failure. When a Linux sensor is in RFM, it will only provide basic prevention capabilities, such as blocking known malware hashes and preventing script execution from the /tmp directory. The sensor will not send any telemetry or detection events to the Falcon platform, and will not receive any policy or update changes from the Falcon

No community discussion yet for this question.