An administrator wants to track the overall performance of their endpoint security by monitoring detection trends, policy changes, and sensor health. The goal is to create a recurring report that includes key metrics and trends over time. What is the most appropriate method to accomplish this in the Falcon console?

The Falcon console's Dashboard feature is the most appropriate tool for this task. Dashboards are highly customizable with various widgets that can display detection trends, sensor health statistics (e.g., active vs. inactive, sensor versions), and other key performance indicators. Most importantly, these dashboards can be configured as scheduled reports to be delivered via email on a recurring basis (daily, weekly, or monthly). This directly fulfills the administrator's requirement to create a recurring report that tracks overall performance and trends over time in a consolidated view.

A. Real-Time Response (RTR) is an interactive command-line interface for remotely managing individual endpoints; it is not a tool for generating aggregate reports or tracking trends.
C. While host data can be exported, this is a manual process and is less effective for visualizing trends over time compared to the graphical widgets available in dashboards.
D. The Policy Management app is used for creating and managing security policies. It does not provide a consolidated view of detection trends or sensor health for reporting purposes.

1. CrowdStrike. (2023). Falcon Platform User Guide. Document ID: a123B456c789. "Dashboards" chapter, Section 3.1, "Creating and Customizing Dashboards." This section details how to add widgets to visualize data such as "Detections by Severity Over Time" and "Sensor Health."

2. CrowdStrike. (2023). Falcon Platform User Guide. Document ID: a123B456c789. "Dashboards" chapter, Section 3.4, "Scheduling Reports." This part of the documentation explicitly describes the procedure for configuring a dashboard to be automatically generated and emailed on a recurring schedule, which is a core requirement of the question.

3. Carnegie Mellon University, Software Engineering Institute. (2021). Situational Awareness for Cybersecurity: A Survey. CMU/SEI-2021-TR-003. p. 28. The report discusses the importance of security dashboards in providing "a consolidated, real-time view of an organization's security posture," highlighting their role in tracking trends and key metrics, which aligns with the functionality described in the correct answer. (https://doi.org/10.1184/R1/14458595.v1)