CrowdStrike
CCFR-201B · Question #18
After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine…
The correct answer is D. aid and TargetProcessId_decimal. You've hit your limit · resets 12:50am (America/New_York)
Event Data Analysis and Investigation
Question
After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?
Options
- ASHA256 and TargetProcessId_decimal
- BSHA256 and ParentProcessId_decimal
- Caid and ParentProcessId_decimal
- Daid and TargetProcessId_decimal
How the community answered
(17 responses)- A12% (2)
- B6% (1)
- C12% (2)
- D71% (12)
Explanation
You've hit your limit · resets 12:50am (America/New_York)
Topics
#ProcessRollup2#Process Timeline#aid#TargetProcessId_decimal
Community Discussion
No community discussion yet for this question.