The Events Data Dictionary found in the Falcon documentation is useful for writing hunting queries because:

The correct answer is C. It provides a reference of information about the events found in the Investigate > Event Search. This is the correct answer for the same reason as above. The Events Data Dictionary provides a Falcon Console, which is useful for writing hunting queries. It does not provide pre-defined queries, detect names and descriptions, or compatible splunk commands.

Falcon Platform Documentation and Resources

Question

Options

AIt provides pre-defined queries you can customize to meet your specific threat hunting needs
BIt provides a list of all the detect names and descriptions found in the Falcon Cloud
CIt provides a reference of information about the events found in the Investigate > Event Search
DIt provides a list of compatible splunk commands used to query event data

How the community answered

(29 responses)

B
3% (1)
C
90% (26)
D
7% (2)

Explanation

This is the correct answer for the same reason as above. The Events Data Dictionary provides a Falcon Console, which is useful for writing hunting queries. It does not provide pre-defined queries, detect names and descriptions, or compatible splunk commands.

Topics

#Events Data Dictionary#Falcon documentation#Event Search reference#hunting queries

Community Discussion

No community discussion yet for this question.

Full CCFH-202B Practice