先試後買

A. The Operating System PID of the parent.

B. The TargetProcessId_decimal of the parent process.

C. The ContextProcessId_decimal of the system.

D. The RootProcessId_decimal of the entire tree.

A. Scripts (.ps1, .sh)

B. Executions (Process starts)

C. Executables (.exe)

D. Archive files (.zip, .7z)

A. Average time to resolve a detection.

B. The top 10 hosts/users/files with the most detections.

C. The breakdown of True Positive vs. False Positive resolutions.

D. Total number of detections resolved by each analyst.

A. It prevents file uploads to the CrowdStrike cloud from that file path

B. It excludes host information from Detections and Incidents generated within that file path location

C. It disables detection generation from that path, however the sensor can still perform prevention actions

D. It excludes sensor monitoring and event collection for the trusted file path

A. During the ' Understand process(es) involved ' phase.

B. During the ' Understand the detection ' phase.

C. After the incident has been fully remediated.

D. During the ' Examine what is normal for the system ' phase.

A. stop all ML-based detections and preventions for the matching path(s) and/or stop files from being uploaded to the CrowdStrike Cloud

B. Stop all Machine Learning Preventions but a detection will still be generated and files will still be uploaded to the CrowdStrike Cloud

C. stop all detections for a specific pattern ID

D. stop all sensor data collection for the matching path(s)

A. It contains the ContextProcessld_decimal value for the parent process that made the DNS request

B. It contains the TargetProcessld_decimal value for the process that made the DNS request

C. It contains the TargetProcessld_decimal value for other related events

D. It contains an internal value not useful for an investigation

A. Recent network connections and IP addresses.

B. List of local user accounts and administrators.

C. Macro Execution History for Microsoft Office products.

D. List of running services and drivers.

A. View Incident > Connect to host

B. Investigate > Connect to host

C. Actions > Connect to host

A. The file is internally developed software unique to the organization.

B. The file is a known commodity tool used by many different actors.

C. The file is a standard Windows system component.

D. The file is common off-the-shelf malware seen globally.

A. Identifies a detailed list of all process executions for the specified hashes

B. Identifies hosts that loaded or executed the specified hashes

C. Identifies detections related to the specified hashes

D. Identifies users associated with the specified hashes

A. Lateral Movement

B. Follow Through

C. Contact Controlled Systems

D. Gain Access

A. They allow for pattern matching using wildcards or specific strings.

B. They can generate ' Informational ' detections if set to the ' Monitor ' action.

C. They can be used to monitor or block specific command-line strings.

D. A Custom IOA rule group can only be applied to one single prevention policy.