All CCFR-201b Test Inside CrowdStrike Questions

Domain name-based IOCs in Falcon are used for detection-oriented visibility, not endpoint prevention in the same way as file-hash indicators. File hashes can support blocking or allowing because the sensor can evaluate executable content directly. Domains are network indicators, so the practical actions available are limited to detection or no enforcement action. “Detect only” creates visibility when matching activity is observed, while “No action” allows the indicator to be stored or staged without triggering enforcement behavior. Options that include “Block” or “Allow” are incorrect because domain-based IOCs do not work like hash allowlists or prevention hashes in Falcon IOC Management. This distinction is important for responders because choosing the wrong IOC type or expected action can lead to false assumptions about containment capability.