A security analyst at your organization needs access to the Falcon dashboard to view threat alerts and generate summary reports but must not be able…

The Read-Only Analyst role is specifically designed to grant view-only access to the Falcon platform. This role allows a user to see all data, including threat alerts, dashboards, and events, and to generate reports for situational awareness and analysis. Crucially, it prohibits any modifications, such as changing detection statuses, altering policies, or taking response actions on hosts. This aligns perfectly with the principle of least privilege for an analyst who only needs to monitor and report, ensuring they cannot inadvertently or intentionally change the security posture.

B. Admin: This role has full administrative privileges and can modify all system settings and policies, which is explicitly forbidden by the requirements.

C. Investigator: This role can perform response actions on hosts (e.g., network containment), which constitutes a modification capability beyond simple viewing and reporting.

D. Analyst: This role can manage detections (e.g., change their status or assign them), which is a form of modification not permitted by the scenario's requirements.

1. CrowdStrike Falcon Platform Documentation: In the "User Management" section

the documentation defines the built-in roles. The Read-Only Analyst role is described as having the ability to view all console data but lacking any permissions to create

modify

or delete configurations or take any response actions. This is contrasted with the Analyst

Investigator

and Admin roles

which are granted progressively greater modification and action privileges. (Reference: CrowdStrike Falcon® Platform Documentation

Host and Cloud Security > Users

Section: "Assigning Roles to Users").

2. University Courseware - Cybersecurity Operations: Curricula in advanced cybersecurity operations often use leading platforms like Falcon as case studies. Course materials explain that Role-Based Access Control (RBAC) is fundamental to security operations. A "read-only" or "auditor" role is a standard implementation of the principle of least privilege for personnel who require visibility without control

such as compliance officers or monitoring analysts. (Reference: Based on common curriculum structures in courses like SANS FOR508

which detail incident response toolsets and operational best practices).