An organization has detected unauthorized access to one of its administrative accounts in the CrowdStrike Falcon platform. The security team needs to determine which actions were performed by the compromised account, including configuration changes and rule modifications. Which audit log should the team use to gather this information?

The User Activity Audit Log is the designated location within the CrowdStrike Falcon platform for tracking all actions performed by users. This log provides a detailed, chronological record of user-initiated events, including logins, logouts, creation and modification of prevention policies, changes to detection rules, and other administrative configuration adjustments. When investigating a compromised administrative account, this log is the primary source of truth for identifying all activities, both legitimate and malicious, that were executed by that user, directly addressing the security team's need to understand the scope of the breach.

A. Host Management Audit Log: This log specifically tracks events related to endpoint management, such as moving hosts between groups or sensor version updates, not all user-driven configuration changes.
B. System Events Audit Log: This is not a standard, specifically named log in the Falcon platform for this purpose. User actions are explicitly captured in the User Activity log.
D. Detection Events Audit Log: This log records security detections and incidents occurring on endpoints, not the administrative actions performed by users within the Falcon console itself.

1. CrowdStrike Falcon Documentation: Investigate > Audit logs. The official documentation specifies that the "User Activity" log provides "a record of actions taken by users in your Falcon environment." It details that this includes events like "Policy created," "User role updated," and "Exclusion created," which directly correspond to the configuration and rule modifications mentioned in the question. (Accessed via CrowdStrike Falcon product UI, specific URL is session-dependent but located under the "Investigate" application).

2. CrowdStrike University Courseware: CCFA-200: CrowdStrike Certified Falcon Administrator. Module: "Falcon Platform Management." This course material explains that for auditing administrative changes, security personnel must consult the User Activity Audit Log. It differentiates this from other logs by emphasizing its focus on user-initiated actions versus system- or host-centric events. (Reference: CCFA-200 Student Guide, Section on Auditing and Reporting).