Which of the following is a recommended technique to find unique outliers among a set of data in the Falcon Event Search?
This is the difference between a Host Search and a Host Timeline. A Host Search is an Investigate tool that allows you to view events by category, such as process executions, network connections, file writes, etc. A Host Timeline is an Investigate tool that allows you to view all events in chronological order, without any categorization. Both tools can be used for detection investigation and proactive hunting, depending on the use case and preference. You can access a Host Search from a detection or manually enter the host details. You can also populate the Host Timeline fields manually or from other pages in Falcon.
Cordell
20 days agoTy
26 days agoLillian
13 hours agoDestiny
1 months agoWhitley
22 days agoVivienne
1 months agoJina
2 months agoRosita
19 days agoKanisha
23 days agoMargot
27 days agoKirk
2 months agoErick
2 months agoGussie
2 months ago