An administrator disables detections on a specific host within the Falcon Console. What will be the result of this action?

The CrowdStrike Falcon platform architecture distinctly separates the functions of detection and prevention. These are configured independently within a prevention policy. Disabling "detections" for a host means the sensor will no longer generate and send alert data to the Falcon Console for activities that match detection criteria. However, the prevention capabilities, which are governed by separate settings within the same policy, remain active. Therefore, the sensor will continue to block malicious files and behaviors as configured in its policy, even though it will not create a corresponding detection alert in the user interface. This allows for reducing alert fatigue from specific systems while maintaining protection.

A. Telemetry data collection is a core function of the Falcon sensor for EDR and threat hunting; it is not disabled when detections are turned off.
B. This is too broad. Disabling detections is a specific policy setting; other critical settings, especially for prevention, will continue to be enforced.
C. This describes the opposite scenario. The question explicitly states detections are disabled, meaning detection alerts will not be sent.

1. CrowdStrike, Inc. (2023). Falcon Platform for Windows: Prevention Policy Settings Guide. CrowdStrike Documentation Portal. In the sections detailing prevention categories such as "Next-Generation Antivirus" and "Behavior-Based Prevention," the guide illustrates that "Detection" and "Prevention" are managed by separate, independent controls (e.g., on/off toggles or multi-level sliders). An administrator can disable Detection while keeping Prevention active.

2. CrowdStrike, Inc. (2023). Host and Host Group Management Guide. CrowdStrike Documentation Portal. This guide explains how hosts are managed via groups, which are assigned specific policies. Moving a host to a group with a "prevention-only" policy (detections disabled) is the mechanism to achieve the action described in the question, confirming the separation of these functions.

3. Zimba, A., & Chishimba, M. (2021). A Generic Framework for Endpoint Detection and Response. International Journal of Computer Network and Information Security, 13(5), 43-55. Section 3, "EDR Generic Framework," discusses the distinct components of EDR systems, including data collection, detection, and response/prevention, highlighting their modular and often independently configurable nature. This architectural principle supports that disabling one function (detection) does not inherently disable another (prevention). DOI: https://doi.org/10.5815/ijcnis.2021.05.04