Which of the following is TRUE regarding disabling detections for a host?

Disabling detections for a host, typically done by assigning it to a Prevention Policy with detection capabilities turned off, only prevents the generation of new detections. It does not alter or remove existing detections associated with that host. The DetectionSummaryEvent is sent to the Falcon Streaming API whenever a new detection is created OR when an existing detection is updated (e.g., an analyst changes its status or assignment). Because existing detections can still be modified, DetectionSummaryEvents for that host can continue to be sent to the Streaming API, making this statement true.

A. Reduced Functionality Mode (RFM) is a sensor health state, typically caused by technical issues like kernel incompatibility or licensing problems, not by a policy change disabling detections.

B. Disabling detections is a forward-looking action. All historical data, including events related to prior detections, is preserved in Event Search for forensic and analytical purposes.

D. The first part of this statement is incorrect. Existing detections for the host are preserved in the console and are not removed when future detections are disabled.

1. CrowdStrike Falcon® Platform Documentation, Falcon Streaming API V2, "Event Dictionary": The documentation for the DetectionSummaryEvent specifies its trigger conditions. It states, "This event is generated whenever a new detection is created or an existing detection is updated." This confirms that even if new detections are disabled, updates to old detections will still generate this event.

2. CrowdStrike Falcon® Platform Documentation, Prevention Policies, "Creating a New Prevention Policy": This section details the effect of policy settings. It clarifies that disabling detection settings prevents the creation of new detections but does not affect existing ones. This directly refutes option D's claim that existing detections are removed and option B's claim that data is removed.

3. CrowdStrike Falcon® Platform Documentation, Sensor Health, "Reduced Functionality Mode (RFM)": This document defines RFM as a sensor state resulting from a critical error, distinguishing it from an administrative policy setting. This directly refutes option A.