Which of the following is NOT a valid event type?

The CrowdStrike Falcon platform uses a specific and well-defined schema for event types recorded by the sensor. ProcessRollup2, EndOfProcess, and DnsRequest are all valid and searchable event types (eventsimpleName) within Falcon's Event Search. The event that logs the creation of a new process is named ProcessCreation. The term StartofProcess is not a recognized event type in the Falcon event data dictionary, and a query for it would not return any process creation events.

B: EndOfProcess is a valid event type that is logged when a process terminates. C: ProcessRollup2 is a valid event type that provides a periodic summary of a process's activity. D: DnsRequest is a valid event type that captures DNS queries made by a process.

1. CrowdStrike Falcon® Documentation, "Event Data Dictionary," Document ID: CS-FAL-EDD-1122, Appendix A: Event Types.

2. CrowdStrike University, "CCFR-201b Falcon Platform for Responders," Module: Introduction to Event Search, Section: Common Event Types, p. 35.