Full Access CrowdStrike CCFR-201b Tutorials

Identifying future threats using predictive AI models.

Applying an investigative approach across historical timed buckets of telemetry to find past activity.

Terminating a malicious process as it starts to execute.

Recovering files that were encrypted by a ransomware attack.

IP Summary information from Falcon events containing the given IP

Threat Graph Data for the given IP from Falcon sensors

Unmanaged host data from system ARP tables for the given IP

IP Detection Summary information for detection events containing the given IP

It allows for the automated decryption of files affected by ransomware.

It provides a standardized view of the attack lifecycle to help understand adversary behavior.

It enables the sensor to block kernel-level drivers from unknown publishers.

It provides a real-time count of the total number of files on the endpoint.

An existing process was terminated by the user.

A new process was created and started on the endpoint.

A process successfully established a network connection.

A process modified a sensitive registry key.