What is the purpose of the Machine-Learning Prevention Monitoring Report?

The Machine-Learning Prevention Monitoring Report is a predictive tool designed to help administrators tune their prevention policies. Its primary purpose is to show what additional malware detections would have occurred in the environment if different, typically more aggressive, Machine-Learning (ML) prevention settings had been active. This allows an administrator to assess the potential impact of changing ML levels—balancing increased protection against the risk of new false positives—before applying any changes to the live policy.

A. This is incomplete. While it relates to settings and outcomes, its core function is the predictive "what-if" analysis, not just a simple overview of current quarantines.

B. This describes the functionality of the Quarantine Management or Detections pages, which are interactive tools for managing quarantined files, not a report for policy tuning.

C. This describes a real-time activity dashboard (like the Detections app) used for monitoring active threats, not a specific report for evaluating ML policy settings.

1. CrowdStrike, Inc. (2023). Falcon Platform Documentation: Prevention Policy Settings. In the section detailing Machine Learning for Malware Prevention, the documentation explains the function of the monitoring report: "To help you tune your ML settings, the Machine-Learning Prevention Monitoring report (Investigate > Dashboards and Reports) shows you malware that would have been blocked in your environment based on different ML prevention settings." This confirms the report's role as a tool for evaluating the hypothetical impact of different settings.

2. CrowdStrike, Inc. (2023). Falcon Platform Documentation: Dashboards and Reports. The "Machine-Learning Prevention Monitoring Report" subsection explicitly states that the report provides visibility into detections that would have been made at higher ML slider levels (Aggressive and Extra Aggressive) than what is currently configured in the prevention policy. This allows for data-driven decisions when adjusting policy aggressiveness.