Which of the following is a way to create event searches that run automatically and recur on a schedule that you set?

Scheduled Searches is a feature within the CrowdStrike Falcon platform specifically designed to automate the execution of event searches. Users can save a query, define a schedule (e.g., hourly, daily), and have it run automatically. The results can be used to populate dashboard panels, generate alerts, or be sent to other systems, enabling proactive and continuous threat hunting.

A. Workflows: Workflows are for automating response actions based on triggers like new detections, not for running recurring event searches.

B. Event Search: This is the interface for performing manual, ad-hoc queries, not for scheduling them to run automatically.

D. Scheduled Reports: This feature is for formatting and distributing the results of data queries on a schedule, but "Scheduled Searches" is the underlying feature that runs the query itself.

1. CrowdStrike, Inc. (2023). CrowdStrike Falcon® Platform Documentation, "Investigate and Hunt Threats" section, "Scheduled Searches" subsection. This document details the process of creating, scheduling, and managing automated searches.

2. CrowdStrike University. (2023). CCFH 202b Student Guide, Module 7: "Automating Hunting". This courseware explains how Scheduled Searches are used to operationalize threat hunting activities.