You have determined that you have numerous Machine Learning detections in your environment that are false positives. They are caused by a single binary that was custom written by a vendor for you and that binary is running on many endpoints. What is the best way to prevent these in the future?
What is the purpose of a containment policy?
An administrator creating an exclusion is limited to applying a rule to how many groups of hosts?
Even though you are a Falcon Administrator, you discover you are unable to use the "Connect to Host" feature to gather additional information which is only available on the host. Which role do you need added to your user account to have this capability?
What must an admin do to reset a user's password?
What is the function of a single asterisk (*) in an ML exclusion pattern?
