What is the difference between a Host Search and a Host Timeline?

The Host Search feature in the Falcon console provides a categorized view of endpoint data. It organizes events by type, such as Process Executions, Network Connections, DNS Requests, and more. This allows an analyst to quickly pivot between different types of activity. In contrast, the Host Timeline presents a raw, chronological stream of all events captured by the Falcon sensor on that specific host. It is a temporal view, showing the sequence of events as they occurred, which is useful for understanding the exact order of operations during an incident.

B. The Host Timeline includes all event types recorded by the sensor, not just process executions and user activity.
C. This option incorrectly reverses the definitions of Host Search and Host Timeline. The Timeline is temporal, and the Search is organized by data type.
D. These are two distinct features within the Falcon UI, each serving a different analytical purpose.

1. CrowdStrike. (2023). Falcon User Guide. "Investigate App," Chapter: Host and User Search, Section: "Host Search vs. Host Timeline." This section details the functional differences, describing Host Search as a "categorized view" and Host Timeline as a "chronological list of events."