Which of the following is returned from the IP Search tool?

The IP Search tool, located within the Falcon console's Investigate application, is used to query endpoint event data. When an IP address is searched, the tool returns a summary of all network-related events involving that IP. This includes a list of hosts within the environment that have communicated with the specified IP address, the processes responsible for the communication, and the timestamps of these events. It provides a historical view of interactions with the IP based on data collected by the Falcon sensor.

B. The Threat Graph is a tool for visualizing process execution trees and relationships, not for querying IP-specific event summaries.
C. The IP Search tool queries data from managed hosts with Falcon sensors, not ARP tables from unmanaged systems.
D. The tool returns information from all relevant events, not just detection events, providing a broader context of IP activity.

1. CrowdStrike, Inc. (2023). Falcon Platform User Guide. "Investigate Application," Chapter 7, Section: "Searching for Indicators." This section describes the functionality of searching for IPs, domains, and hashes, and clarifies that the results are derived from collected event data.

2. CrowdStrike, Inc. (2022). Getting Started with the Falcon Platform. "Investigate," Page 21. The document explains that the Investigate app allows searching for artifacts like IP addresses to see which hosts have interacted with them.