What is the difference between a Host Search and a Host Timeline?

Question

Options

• AHost Search is used for detection investigation and Host Timeline is used for proactive hunting
• BA Host Search organizes the data in useful event categories like process executions and network
• CYou access a Host Search from a detection to show you every recorded process event related to
• DThere is no difference. You just get to them different ways

• A
  2% (1)
• B
  94% (46)
• D
  4% (2)

Explanation

This is the difference between a Host Search and a Host Timeline. A Host Search is an Investigate tool that allows you to view events by category, such as process executions, network connections, file writes, etc. A Host Timeline is an Investigate tool that allows you to view all events in chronological order, without any categorization. Both tools can be used for detection investigation and proactive hunting, depending on the use case and preference. You can access a Host Search from a detection or manually enter the host details. You can also populate the Host Timeline fields manually or from other pages in Falcon.

No community discussion yet for this question.