Which of the following options is a feature found ONLY with the Sensor-based Machine Learning (ML)?

The sensor-based Machine Learning (ML) engine is a critical component of the CrowdStrike Falcon sensor that operates directly on the endpoint. Its specific design purpose is to provide autonomous protection by analyzing files and processes locally, without requiring a connection to the CrowdStrike cloud. This architecture is what enables the Falcon platform to deliver continuous, real-time protection against both known and unknown malware, even when the endpoint is offline or disconnected from the internet. This capability is unique to the on-sensor components, as other features like cloud-based ML inherently require connectivity.

A. Next-Gen Antivirus (NGAV) protection is a broad term for the entire Falcon Prevent solution, which includes sensor-based ML, cloud-based ML, and behavioral analysis (IOAs), not just one component.
B. Adware and Potentially Unwanted Program (PUP) detection is a policy feature that leverages multiple engines, including cloud intelligence and file hashes, not solely the sensor-based ML.
D. Both the sensor-based and the more powerful cloud-based ML engines identify and analyze unknown executables; therefore, this capability is not exclusive to the sensor-based engine.

1. CrowdStrike

"Falcon Prevent: Next-Generation Antivirus" Datasheet.

Reference: Page 2

"How It Works" section. The document states

"On the endpoint

a lightweight agent is driven by...machine learning to provide protection against known and unknown malware

online and offline." This explicitly links the on-sensor component to offline protection.

2. CrowdStrike

"The Power of the CrowdStrike Falcon Platform" White Paper.

Reference: Section "Machine Learning and Artificial Intelligence

" Page 6. The paper distinguishes between the ML that runs "directly on the endpoint" for "instantaneous protection even when offline" and the ML that runs in the cloud

which leverages a much larger dataset. This confirms that offline capability is a specific function of the sensor-based engine.

3. CrowdStrike

"Cloud-Native Endpoint Protection For Dummies" E-book.

Reference: Chapter 3

"Stopping Breaches with Next-Generation Endpoint Protection

" Page 23. The text explains

"The Falcon agent has machine learning and behavioral detection capabilities built in

so it can protect the endpoint even when it’s not connected to the internet." This directly attributes offline capabilities to the agent's (sensor's) built-in features.