You are reviewing a list of domains recently banned by your organization's acceptable use policy. In particular, you are looking for the number of hosts that have visited each domain. Which tool…

The correct answer is C. Bulk Domain Search. Bulk Domain Search is the tool that you should use in Falcon to review a list of domains recently banned by your organization's acceptable use policy and look for the number of hosts that have visited each domain. Bulk Domain Search is an Investigate tool that allows you to…

Threat Hunting and Investigation

Question

You are reviewing a list of domains recently banned by your organization's acceptable use policy. In particular, you are looking for the number of hosts that have visited each domain. Which tool should you use in Falcon?

Options

ACreate a custom alert for each domain
BAllowed Domain Summary Report
CBulk Domain Search
DIP Addresses Search

How the community answered

(33 responses)

A
3% (1)
B
6% (2)
C
76% (25)
D
15% (5)

Explanation

Bulk Domain Search is the tool that you should use in Falcon to review a list of domains recently banned by your organization's acceptable use policy and look for the number of hosts that have visited each domain. Bulk Domain Search is an Investigate tool that allows you to search for multiple domains at once and view their network connection events across all hosts in your environment. It shows information such as domain name, number of hosts visited, number of detections generated, etc. for each domain. Create a custom alert for each domain, Allowed Domain Summary Report, and IP Addresses Search are not tools that you should use for this

Topics

#Bulk Domain Search#domain investigation#acceptable use policy#tool selection

Community Discussion

No community discussion yet for this question.

Full CCFH-202B Practice