What action is used when you want to save a prevention hash for later use?

When an analyst wants to prevent a specific file from executing across the environment based on its hash, the correct action is "Always Block." This adds the file's SHA256 hash to the custom Indicators of Compromise (IOCs) list with a prevention policy action. Once saved, any attempt to execute a file matching this hash on a host with an active prevention policy will be blocked by the Falcon sensor. This is a core function of custom IOC-based threat prevention within the Falcon platform.

B. "Never Block" is a whitelisting action used to override other blocking logic and explicitly permit a file.

C. "Always Allow" is another whitelisting action, functionally similar to "Never Block," ensuring a file is permitted to run.

D. "No Action" would add the hash for detection and visibility purposes only, without taking any preventative measures.

1. CrowdStrike. (2023). Falcon Prevention Policy Guide. "Custom IOCs (Hashes)," Section: "Managing Custom IOCs," pp. 12-14. The guide specifies that the "Always Block" policy is used to prevent files with matching hashes from running.

2. CrowdStrike. (2023). Falcon User Guide. "IOC Management," Chapter: "Creating and Managing Indicators," Section: "Hash IOCs." This section details the available actions for hash IOCs, defining "Always Block" as the primary prevention setting.