CrowdStrike Exam CCFH-202 Topic 8 Question 25 Discussion

Actual exam question for CrowdStrike's CCFH-202 exam

Question #: 25
Topic #: 8

You need details about key data fields and sensor events which you may expect to find from Hosts running the Falcon sensor. Which documentation should you access?

AEvents Data Dictionary

BStreaming API Event Dictionary

CHunting and Investigation

DEvent stream APIs

Show Suggested Answer

Suggested Answer: B

The Linux Sensor report is where an analyst would find information about shells spawned by root, Kernel Module loads, and wget/curl usage. The Linux Sensor report is a pre-defined report that provides a summary view of selected activities on Linux hosts. It shows information such as process execution events, network connection events, file write events, etc. that occurred on Linux hosts within a specified time range. The Sensor Health report, the Sensor Policy Daily report, and the Mac Sensor report do not provide the same information.

by Trinidad at Aug 05, 2024, 04:45 AM

Limited Time Offer

25%

Off

Get Premium CCFH-202 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Thora

29 days ago

I bet the Events Data Dictionary is full of exciting things like 'SensorEvent' and 'ProcessEvent'. What a thrilling read that will be!

upvoted 0 times

...

Brendan

1 months ago

Hunting and Investigation? Really? That doesn't sound like the right place to find sensor event details. Unless they're using it to 'hunt' for the information I need.

upvoted 0 times

Josefa

2 days ago

B) Streaming API Event Dictionary

upvoted 0 times

...

Celia

19 days ago

A) Events Data Dictionary

upvoted 0 times

...

Kenneth

1 months ago

Hmm, I'm not sure. Maybe the Event stream APIs would be a good option? I'll have to take a closer look at the descriptions.

upvoted 0 times

Breana

3 days ago

You should check out the Hunting and Investigation documentation for that information.

upvoted 0 times

...

Colton

7 days ago

The Hunting and Investigation documentation could also provide insights on key data fields and sensor events.

upvoted 0 times

...

Meghann

9 days ago

I believe the Streaming API Event Dictionary could provide the details you need.

upvoted 0 times

...

Laurel

10 days ago

I would suggest checking out the Streaming API Event Dictionary for that information.

upvoted 0 times

...

Gerald

15 days ago

I think the Events Data Dictionary might have what you're looking for.

upvoted 0 times

...

Lindsey

1 months ago

I think the Events Data Dictionary might have the details you need.

upvoted 0 times

...

Suzi

2 months ago

The Streaming API Event Dictionary seems like it would have the information I need. That's my pick for this question.

upvoted 0 times

Ronald

18 days ago

Hunting and Investigation documentation could also have the key data fields you need.

upvoted 0 times

...

Lorenza

1 months ago

The Streaming API Event Dictionary is a good choice for details on sensor events.

upvoted 0 times

...

Shenika

1 months ago

I would go with the Event stream APIs for that information.

upvoted 0 times

...

Britt

2 months ago

I think the Events Data Dictionary might have what you're looking for.

upvoted 0 times

...

Diane

2 months ago

I think the Events Data Dictionary would be the best place to find details on the key data fields and sensor events from the Falcon sensor. It sounds like the most relevant documentation.

upvoted 0 times