Which statement is TRUE regarding disabling detections on a host?

Question

Options

• AHosts with detections disabled will not alert on blocklisted hashes or machine learning detections,
• BHosts with detections disabled will not alert on anything until detections are enabled again
• CHosts with detections disabled will not alert on anything for 24 hours (by default) or longer if that
• DHosts cannot have their detections disabled individually

• B
  90% (28)
• C
  3% (1)
• D
  6% (2)

Explanation

The statement that is true regarding disabling detections on a host is that hosts with detections disabled will not alert on anything until detections are enabled again. As explained in question 127, disabling detections for a host will stop the sensor from sending any detection or prevention events to the Falcon console, and remove any existing events for that host from the console. This means that the host will not alert on anything, including blocklisted hashes, machine learning detections, or indicator of attack (IOA)-based detections. The host will remain in this state until detections are enabled again.

No community discussion yet for this question.