An analyst on the security team noticed that several alerts are false positives within Enterprise EDR. The analyst disables the IOC within the report from those alerts.Which statement correctly explains what disabling the IOC will accomplish?
Which identifier is shared by all events when an alert is investigated?
An Enterprise EDR administrator wants to use Watchlists curated by VMware Carbon Black and other threat intelligence specialists.How should the administrator add these curated Watchlists from the Watchlists page?
An incorrectly constructed watchlist generates 10,000 incorrect alerts.How should an administrator resolve this issue?
Which list below captures all Enforcement Levels for App Control policies?
A company uses Audit and Remediation to check configurations and adhere to compliance regulations. The regulations require monthly reporting and twelve months of data retained.How can an administrator accomplish this requirement with Audit and Remediation?
