The Falcon sensor can take several automated actions to protect an endpoint. Which of the following is NOT an action that Falcon takes upon detection?

You receive an email from a third-party vendor that one of their services is compromised,thevendor names a specific IP address that the compromised service was using. Where would you input this indicator to find any activity related to this IP address?

In various telemetry events like 'FileWrite' or 'NetworkConnect', Falcon identifies the process that performed the action. Which field will always identify this "acting" process?

What are Event Actions?

In the 'User Search - File Written' section, a responder can see various files dropped by a user. Which of the following file types CANNOT be seen from this view?