CCFH-202B · Question #26
What Investigate tool would you use to allow an analyst to view all events for a specific host?
The correct answer is C. Host Timeline. The Host Timeline is the Investigate tool that you would use to allow an analyst to view all events for a specific host. The Host Timeline shows a graphical representation of all events that occurred on a host within a specified time range. It allows an analyst to zoom in and…
Question
What Investigate tool would you use to allow an analyst to view all events for a specific host?
Options
- ABulk Timeline
- BHost Search
- CHost Timeline
- DProcess Timeline
How the community answered
(20 responses)- C95% (19)
- D5% (1)
Explanation
The Host Timeline is the Investigate tool that you would use to allow an analyst to view all events for a specific host. The Host Timeline shows a graphical representation of all events that occurred on a host within a specified time range. It allows an analyst to zoom in and out, filter by event type or name, and drill down into event details. The Bulk Timeline, the Host Search, and the Process Timeline are not Investigate tools that you would use to view all events for a specific host.
Topics
Community Discussion
No community discussion yet for this question.