Which document provides information on best practices for writing Splunk-based hunting queries, predefined queries which may be customized to hunt…

The Hunting and Investigation guide is the designated document that provides best practices and predefined queries for threat hunting. It includes guidance on how to effectively write and structure queries in Falcon's Event Search (which uses a Splunk-like syntax). The guide is organized by hunting use cases, offering specific, customizable queries to hunt for common indicators of malicious activity, such as suspicious network connections and anomalous process executions. This content is designed to help analysts apply proven techniques to their own data.

A: The Real Time Response and Network Containment guide covers direct interaction with and isolation of endpoints, not proactive data querying.

C: The Events Data Dictionary is a reference that defines event data fields, but it does not provide hunting queries or best practices.

D: The Incident and Detection Monitoring guide is focused on workflows for managing and responding to generated alerts, not proactive hunting.

- CrowdStrike Falcon® Platform Documentation, "Hunting and Investigation Guide," Section: Best Practices for Writing Queries.

- CrowdStrike Falcon® Platform Documentation, "Hunting and Investigation Guide," Section: Hunting for Suspicious Network Activity.

- CrowdStrike Falcon® Platform Documentation, "Hunting and Investigation Guide," Section: Hunting for Suspicious Process Activity.