CrowdStrike CCFR-201b Exam Dumps

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, Reduced Functionality Mode (RFM) is a state where a host's sensor has limited functionality due to various reasons, such as license expiration, network issues, tampering attempts, etc1.You can find hosts that are in RFM by using the Host Search tool and filtering by Sensor Status = RFM1.You can also view details about why a host is in RFM by clicking on its hostname1.

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Activity View allows you to view all events generated by a process involved in a detection in a rows-and-columns style view1.This can be helpful because it creates a consolidated view of all detection events for that process that can be exported for further analysis1.You can also sort, filter, and pivot on the events by various fields, such as event type, timestamp, file name, registry key, network destination, etc1.

According to theCrowdStrike Falcon Data Replicator (FDR) Add-on for Splunk Guide, IOA exclusions allow you to exclude files or directories from being detected or blocked by CrowdStrike's indicators of attack (IOAs), which are behavioral rules that identify malicious activities1.This can reduce false positives and improve performance1.When you configure and apply an IOA exclusion, the impact is that the associated detection will be suppressed and the associated process would have been allowed to run1.This means that you will not see any alerts or events related to that IOA in the console1.

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline search returns all cloudable events associated with a given process, such as process creation, network connections, file writes, registry modifications, etc1.This allows you to see a comprehensive view of what a process was doing on a host1.

According to theCrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the IP Search tool allows you to search for an IP address and view a summary of information from Falcon events that contain that IP address1.The summary includes the hostname, sensor ID, OS, country, city, ISP, ASN, geolocation, process name, command line, and organizational unit of the host that communicated with that IP address1.This is an advantage of using the IP Search tool because it provides host, process, and organizational unit data without the need to write a query1.