What is the purpose of a containment policy?

The primary purpose of a containment policy within the CrowdStrike Falcon platform is to define network communication exceptions for hosts that have been placed in network containment. When a host is contained, it is isolated from the network to prevent threat propagation. The containment policy allows administrators to specify a set of rules, such as allowed IP addresses, ports, and protocols. This ensures that authorized personnel and security tools can still access the contained host for forensic investigation and remediation activities while it remains isolated from the general production network.

A. User permissions to contain endpoints are managed by assigning specific roles within Falcon's Role-Based Access Control (RBAC), not through a containment policy.
B. The duration of network containment is not a setting within the containment policy; containment remains active until it is manually lifted by an authorized user.
C. Triggers for automatic containment based on detection severity are configured within Falcon's Prevention Policies, not the containment policy itself.

1. CrowdStrike Falcon® Platform Documentation, Host and sensor management > Contain hosts. The documentation states: "You can create containment policies to allow specific traffic to and from contained hosts. This is useful for allowing your security team to connect to a contained host with remote tools... A containment policy consists of one or more rules that allow traffic." This directly supports the function described in option D.

2. CrowdStrike Falcon® Platform Documentation, Prevention and response policies > Prevention policies. This section details how to configure automatic actions based on detection severity, including "Sensor-based machine learning" and "Execution blocking," which can include automatic containment. This confirms that triggers (Option C) are handled in a different policy type.

3. CrowdStrike Falcon® Platform Documentation, Users and roles > User management. This section explains that user capabilities, such as the ability to contain a host, are governed by assigned roles (e.g., Falcon Administrator, Responder). This refutes the premise of option A.