An administrator needs to configure Indicator of Compromise (IOC) settings in the Falcon platform to reduce the number of false positives reported for specific file hashes flagged as malicious. What is the correct way to achieve this?

The "Custom Indicators" feature in the CrowdStrike Falcon platform is the designated tool for managing custom Indicators of Compromise (IOCs), including file hashes, domains, and IP addresses. To resolve a false positive for a specific file hash, an administrator should add the hash to this list and set the action to "Allow." This creates a precise, centrally managed exception that prevents the Falcon sensor from flagging that specific hash in the future. This approach is the correct and most granular method for handling IOC-based false positives without degrading the overall security posture.

A. Malware Protection exceptions are primarily for tuning machine learning or behavioral-based detections, not for managing custom hash IOCs, which are handled separately.
B. Whitelisting on a local endpoint is not a scalable or recommended practice for a centrally managed platform like Falcon and can be overridden by global policies.
C. Disabling all IOC-based detections is an extreme measure that would create a significant security gap, making it an inappropriate response to a few false positives.

1. CrowdStrike Falcon Documentation

IOC Management: The official documentation details the process of managing IOCs. It specifies that administrators can upload custom indicators (SHA256

MD5

domains

IPs) and assign policies such as "Allow

" "Detect only

" or "Block." The "Allow" action is explicitly defined for creating exceptions to prevent detections. (Accessed via the Falcon Console Help section

under Investigate > Indicators).

2. CrowdStrike

Getting Started with Custom Indicators of Compromise (IOCs): This guide outlines the use cases for custom IOCs

stating

"You can add custom IOCs to your environment to either block known malicious hashes

or allow hashes that may be specific to your environment and you want to be ignored." This confirms that setting an "Allow" action is the intended method for whitelisting. (Referenced in official CrowdStrike support and training materials).