An analyst notices a detection that has been automatically flagged with the ' New Activity ' status. Which of the following statements best describes what this status indicates?
What information does the MITRE ATT AND CK Framework provide?
Refer to the image.
You are using Advanced Event Search to find the event record for a suspicious network connection.
Using the Event List Interactions button for the event, indicated by the arrow in the image above, which option will show all contextual event data around the process execution being investigated?
You can jump to a Process Timeline from many views, like a Hash Search, by clicking which of the following?
A responder needs to find a specific sequence of network connections that did not trigger a detection. Which search tool allows them to search for anything within the raw telemetry?
When investigating system-level persistence, it is critical to know what the services.exe process is responsible for. What is its primary function?
During the incident response process, a responder must update the status of a detection. Which of the following options is NOT a valid detection status recognized by the Falcon console?
When a responder needs to take data out of the Falcon console for external analysis, which of the following is NOT an option when exporting searches?
What actions are available for domain name-based Indicators of Compromise (IOCs) in Falcon?
The Falcon console integrates heavily with the MITRE ATT AND CK framework to provide industry-standard context. Which of the following tactics displayed in the detection UI is a direct implementation of a MITRE ATT AND CK tactic?
TESTED 19 Jul 2026