What steps are required to create a policy with detection only in CrowdStrike Falcon?

What steps are required to create a policy with detection only in CrowdStrike Falcon?

• A. Activate all prevention sliders and disable detection sliders
• B. Set detection sliders to the desired level and disable all prevention sliders
• C. Enable blocking options while keeping detection off
• D. Use a default template without changes

Answer: (B)

To create a policy with detection only in CrowdStrike Falcon, the correct approach is to set the detection sliders to the desired level while disabling all prevention sliders. This ensures that the system will actively monitor and detect threats based on the criteria defined by the sliders, but it will not take any automatic preventative measures such as blocking or quarantining files that are deemed suspicious. The detection sliders allow for customization of how sensitive the alerts should be, tailoring the detection capabilities to the specific needs of the environment. By disabling all prevention sliders, the policy does not interfere with the operations of users or systems but still provides valuable threat detection capabilities, making it a strategic choice for organizations looking to analyze threat exposure without initiating automatic responses. The other options do not align with the goal of having detection only. For instance, having all prevention sliders activated or enabling blocking options would contradict the intention of limiting actions to detection alone. Additionally, opting for a default template might not specifically customize the detection settings to the desired level, making it less effective in meeting specific threat monitoring needs.

To create a policy with detection only in CrowdStrike Falcon, the correct approach is to set the detection sliders to the desired level while disabling all prevention sliders. This ensures that the system will actively monitor and detect threats based on the criteria defined by the sliders, but it will not take any automatic preventative measures such as blocking or quarantining files that are deemed suspicious.

The detection sliders allow for customization of how sensitive the alerts should be, tailoring the detection capabilities to the specific needs of the environment. By disabling all prevention sliders, the policy does not interfere with the operations of users or systems but still provides valuable threat detection capabilities, making it a strategic choice for organizations looking to analyze threat exposure without initiating automatic responses.

The other options do not align with the goal of having detection only. For instance, having all prevention sliders activated or enabling blocking options would contradict the intention of limiting actions to detection alone. Additionally, opting for a default template might not specifically customize the detection settings to the desired level, making it less effective in meeting specific threat monitoring needs.