Falcon limits the number of detections displayed to prevent the UI from becoming overwhelmed. How many detections are displayed per day per Agent ID (AID)?

When examining a raw DNS request event, you see a field called ContextProcessld_decimal. What is the purpose of that field?

Which of the following statements about the 'Detection Activity' report is FALSE?

What is the difference between Managed and Unmanaged Neighbors in the Falcon console?

A security responder is investigating a detection where a low-privileged process attempted to manipulate a system token to gain administrative rights. Within the specific terminology used by the Falcon console,
'Privilege Escalation' is classified as a: