CCFR-201b practice question 2 of 10

From the Detections page, how can you view 'in-progress' detections assigned to Falcon Analyst Alex?

Full set: 60 questions
Answer options
A: Filter on'Analyst: Alex'
B: Alex does not have the correct role permissions as a Falcon Analyst to be assigned detections
C: Filter on 'Hostname: Alex' and 'Status: In-Progress'
D: Filter on 'Status: In-Progress' and 'Assigned-to: Alex* Correct answer
Correct Answer:
D. Filter on 'Status: In-Progress' and 'Assigned-to: Alex*
Explanation

The Detections page in the Falcon UI allows for robust filtering to manage and triage alerts. To find detections that are currently being worked on ('In-Progress') and are assigned to a specific analyst ('Alex'), you would use the available filters. The correct method is to set the 'Status' filter to 'In-Progress' and the 'Assigned-to' filter to the analyst's name, 'Alex'.

Why Incorrect

A. The filter for assignments is labeled 'Assigned-to', not 'Analyst'. Using the incorrect filter name will yield no results.
B. The Falcon Analyst role is specifically designed to investigate and be assigned detections; this statement is factually incorrect.
C. The 'Hostname' filter is used to search for detections on a specific endpoint, not to find detections assigned to an analyst.

References

1. CrowdStrike, Inc. (2023). Falcon User Guide. "Detections" chapter, Section: "Filtering detections". This section provides a detailed overview of all available filters on the Detections page, including 'Status' and 'Assigned-to', and describes their usage for triaging alerts.

Scroll to Top