What Search page would help a threat hunter differentiate testing, DevOPs, or general user activity from adversary behavior?

The User Search page is specifically designed to help an analyst understand the full scope of an individual user's activity. By pivoting on a user identity, a threat hunter can view all associated processes, logons, and network activity across multiple systems. This provides the necessary context to build a baseline of normal behavior for that user. Activities that deviate from this established baseline, such as running unusual tools or accessing sensitive systems at odd hours, can then be more easily identified as potentially malicious, distinguishing them from routine testing, DevOps, or general user tasks.

A. Hash Search is too narrow, focusing on a specific file artifact and providing no context about the user or intent behind its presence.

B. IP Search focuses on network connections to or from a single IP address, lacking the broader context of which user initiated the activity.

C. Domain Search is similar to IP Search, providing information about a network destination but not the user context behind the connection.

1. CrowdStrike. (2023). Falcon Platform User Guide. In the "Investigate App" section, the guide describes "User Search" as a tool to "view a user's recent activity, including logons and all process executions associated with that user," which is essential for user behavior analysis.

2. CrowdStrike. (2022). CCFH 202b: CrowdStrike Certified Falcon Hunter Course Manual. Module 4, "Hunting with the Falcon Platform," explicitly details using User Search to establish baselines and identify anomalous user behavior as a core hunting technique.