Which of the following is TRUE of the Logon Activities Report?

The Logon Activities view, found within the Investigate application of the CrowdStrike Falcon console, is a user-centric tool for analysis. When an analyst selects a specific user, this view presents several key pieces of information designed for quick assessment. This includes a "Logon Times" graph that visually charts the user's logon frequency and timing, and a definitive list of all hosts the user has successfully logged into. This combination of a graphical view and host correlation is fundamental to the report's purpose of identifying anomalous user behavior.

B. The report is centered on a user's activity; while you can investigate a host to see its users, you don't filter the user's report by computer name.

C. This is partially true but less complete than option A. It omits the significant graphical and host-correlation features that define the report's utility for investigation.

D. The report displays a history of logon events over a selected time period, not just the single most recent logon activity.

---

1. CrowdStrike Falcon® Platform Documentation

"Investigate App Guide." The guide details the functionality of the user investigation views. Specifically

in the section covering the "Users" view

it describes the "Logon Activity" page for any selected user. This documentation explicitly mentions and often shows screenshots of the "Logon Times" graph and the list of "Hosts" the user has accessed

confirming the elements described in the correct answer. (Note: Access to this documentation typically requires a CrowdStrike customer account).