CrowdStrike Exam CCFR-201 Topic 2 Question 25 Discussion

Actual exam question for CrowdStrike's CCFR-201 exam

Question #: 25
Topic #: 2

Aside from a Process Timeline or Event Search, how do you export process event data from a detection in .CSV format?

AYou can't export detailed event data from a detection, you have to use the Process Timeline or an Event Search

BIn Full Detection Details, you expand the nodes of the process tree you wish to expand and then click the 'Export Process Events' button

CIn Full Detection Details, you choose the 'View Process Activity' option and then export from that view

DFrom the Detections Dashboard, you right-click the event type you wish to export and choose CSV. JSON or XML

Show Suggested Answer

Suggested Answer: C

According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, there are three ways to export process event data from a detection in .CSV format1:

You can use the Process Timeline tool and click on ''Export CSV'' button at the top right corner1.

You can use the Event Search tool and select one or more events and click on ''Export CSV'' button at the top right corner1.

You can use the Full Detection Details tool and choose the ''View Process Activity'' option from any process node in the process tree view1.This will show you all events generated by that process in a rows-and-columns style view1.You can then click on ''Export CSV'' button at the top right corner1.

by Isreal at Sep 19, 2024, 04:02 PM

Limited Time Offer

25%

Off

Get Premium CCFR-201 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Vivienne

8 months ago

Option B is the way to go, like a ninja sneaking through the process tree. Gotta love that export button, it's the real MVP.

upvoted 0 times

...

Joni

8 months ago

B is the winner! Who needs a process timeline or event search when you can just expand and export. Easy as pie... or is it cake? I'm getting hungry.

upvoted 0 times

...

Julio

8 months ago

D looks tempting, but I feel like that's more for exporting the overall detection data, not the granular process events. I'd go with B to get that CSV export.

upvoted 0 times

Novella

7 months ago

I've tried D before, but B definitely gives you the granular process events in CSV format.

upvoted 0 times

...

Truman

7 months ago

Yeah, I agree. B seems like the best option to get the detailed process events.

upvoted 0 times

...

Aretha

7 months ago

Aretha, I agree with you. B seems like the best choice to export process event data in CSV format.

upvoted 0 times

...

Raylene

7 months ago

Raylene, I see your point, but I believe B is the correct option for exporting detailed process events.

upvoted 0 times

...

Eulah

7 months ago

I think B is the way to go for exporting process event data in CSV format.

upvoted 0 times

...

Norah

7 months ago

I think D is the way to go for exporting process event data.

upvoted 0 times

...

Johnna

8 months ago

Hmm, that makes sense too. I guess it depends on what level of detail you need in the exported data.

upvoted 0 times

...

Bev

8 months ago

I disagree, I believe option C is the right choice because it allows you to view process activity before exporting.

upvoted 0 times

...

Effie

9 months ago

Hmm, I'm torn between B and C. Seems like you can access the process activity from either the full detection details or the view process activity option. Decisions, decisions!

upvoted 0 times

...