When looking at a process tree, what do the nodes represent?
Suspicious RDP connections have been observed on a host within your environment. How do you utilize Event Search to show all connections on this specific host?
To best determine the root cause of an enterprise wide infection you would:
Which of the following process trees should raise the most suspicion that adversary activity may be present on a web server?
When searching for all events related to a specific process which field(s) should be selected in a query from the Event Actions drop down menu?
Your environment has several PowerShell scripts running that are Base64 encoded. Which of the following areas of Falcon will show you the decoded PowerShell commands?
