When performing a raw event search via the Events search page, what are Event Actions?

Question

Options

• AEvent Actions contains an audit information log of actions an analyst took in regards to a specific
• BEvent Actions contains the summary of actions taken by the Falcon sensor such as quarantining
• CEvent Actions are pivotable workflows including connecting to a host, pre-made event searches
• DEvent Actions is the field name that contains the event name defined in the Events Data

• A
  3% (1)
• B
  3% (1)
• C
  86% (31)
• D
  8% (3)

Explanation

When performing a raw event search via the Events search page, Event Actions are pivotable workflows that allow you to perform various tasks related to the event or the host. For example, you can connect to a host using Real Time Response, run pre-made event searches based on the event type or name, or pivot to other investigatory pages such as host search, hash search, etc. Event Actions do not contain audit information log, summary of actions taken by the Falcon sensor, or the event name defined in the Events Data Dictionary.

No community discussion yet for this question.