Which of the following does the Hunting and Investigation Guide contain?

The correct answer is C. Example Event Search queries useful for threat hunting. The Hunting and Investigation guide contains example Event Search queries useful for threat hunting. These queries are based on common threat hunting use cases and scenarios, such as finding suspicious processes, network connections, registry activity, etc. The guide also…

Falcon Platform Documentation and Resources

Question

Options

AA list of all event types and their syntax
BA list of all event types specifically used for hunting and their syntax
CExample Event Search queries useful for threat hunting
DExample Event Search queries useful for Falcon platform configuration

How the community answered

(33 responses)

A
6% (2)
C
91% (30)
D
3% (1)

Explanation

The Hunting and Investigation guide contains example Event Search queries useful for threat hunting. These queries are based on common threat hunting use cases and scenarios, such as finding suspicious processes, network connections, registry activity, etc. The guide also explains how to customize and modify the queries to suit different needs and environments. The guide does not contain a list of all event types and their syntax, as that information is provided in the Events Data Dictionary. The guide also does not contain example Event Search queries useful for Falcon platform configuration, as that is not the focus of the guide.

Topics

#Hunting and Investigation Guide#example queries#Event Search#threat hunting

Community Discussion

No community discussion yet for this question.

Full CCFH-202B Practice