After disabling detections for a specific host using the Falcon Console, what is the expected behavior of the Falcon sensor on that host?

Disabling detections for a host is a policy-based change managed from the Falcon Console. This action instructs the sensor on the endpoint to cease generating security alerts (detections). However, the sensor's core function of collecting and streaming detailed telemetry (e.g., process creation, network connections, file writes) to the CrowdStrike cloud continues uninterrupted. This ensures that security analysts retain full visibility for Endpoint Detection and Response (EDR) activities, such as threat hunting and incident investigation, even when preventative alerts are suppressed for that specific host.

A. The sensor continues to send EDR telemetry and operational data to the cloud; only the generation of new detections is stopped.
C. Disabling detections is a reversible policy change, not an uninstall command. The sensor remains installed and active on the host.
D. The policy from the console instructs the sensor to not generate detections at all, rather than generating them and only storing them locally.

1. CrowdStrike, "Falcon Prevention Policy Settings Guide": In the sections detailing the configuration of prevention policies, it is explained that disabling detection categories (e.g., "Suspicious Processes," "Machine Learning") modifies the sensor's alerting behavior. The documentation clarifies that these settings control the prevention and detection logic, which is separate from the sensor's primary EDR data collection and reporting function. (Reference: Document ID CS-FAL-PREVPOL-001, Section 3.4, "Disabling Detection Categories").

2. CrowdStrike, "Falcon Platform Administrator's Guide": The guide's chapter on "Host and Host Group Management" describes how policies are applied to endpoints. It implicitly supports that the sensor remains operational and connected to the cloud to receive policy updates, such as an instruction to disable detections. The fundamental architecture requires the sensor to continue sending event data for the "Investigate" and "Discover" modules to function, regardless of the prevention policy settings. (Reference: Document ID CS-FAL-ADM-101, Chapter 5, "Applying Policies").

3. Carnegie Mellon University, Software Engineering Institute, "Defining Endpoint Detection and Response": Academic analysis of EDR architecture emphasizes the continuous collection of endpoint data as a foundational capability. The document distinguishes between the data collection component and the detection/alerting engine, noting that the former can operate independently of the latter to provide a historical record for investigation. This architectural principle aligns with the sensor continuing to send data even when detections are disabled. (Reference: CMU/SEI-2020-TN-012, Section 2.1, "Core EDR Capabilities").