Which is a filter within the Host setup and management > Host management page?

The CrowdStrike Falcon console's "Host setup and management > Host management" page provides robust filtering capabilities to help administrators locate and manage endpoints. The Organizational Unit (OU) is a primary and standard filter available on this page. It allows administrators to view and manage hosts based on their structure within an Active Directory environment. This is crucial for applying specific policies, running investigations, or organizing assets logically as they exist within the corporate directory service. Filtering by OU is a fundamental task in enterprise endpoint management.

A. User name: While the 'Last Logged On User' is a filterable attribute, 'User name' as a standalone entity is not a primary filter for the host itself on this page.

C. BIOS Version: Although BIOS Version is a valid host attribute that can be queried using Falcon Query Language (FQL), OU is a more fundamental and commonly used filter for grouping and policy management tasks.

D. Locality: 'Locality' is not a default filter field within the Falcon console. Physical or network location is typically handled using other attributes like 'Site' or through custom-defined host groups and tags.

1. CrowdStrike

Inc. (2023). Falcon User Guide. In the "Investigate" section

under "Searching for Hosts

" the documentation details the available search filters. It explicitly lists ou (Organizational Unit) as a filterable attribute for hosts. For example

a query can be structured as platformname:'Windows'+ou:'Domain Controllers'. This confirms OU is an integrated filter for host management.

2. CrowdStrike

Inc. (2023). Tech Center: Falcon Query Language (FQL) Cheat Sheet. This official resource provides a list of keywords for searching and filtering. The cheat sheet lists ou as a keyword for "Host and Detection" searches. It also lists biosversion

confirming it is searchable

but OU remains a primary organizational attribute for management. The document does not list Locality or a standalone User name field.

3. SANS Institute. (2022). Endpoint Protection and Response in the Cloud with CrowdStrike Falcon. Courseware and associated labs for FOR528 demonstrate the use of the Falcon UI. Lab exercises frequently require students to filter hosts on the Host Management page using criteria such as operating system

sensor version

and Organizational Unit (OU) to apply policies or perform administrative tasks

highlighting its role as a key filter.