A responder needs to find a specific sequence of network connections that did not trigger a detection. Which search tool allows them to search for anything within the raw telemetry?

A responder is analyzing a file's prevalence. If the data shows 'Local: High' and 'Global: Unique', which of the following is the most likely conclusion?

The MITRE-Based Falcon Detections Framework is a core component of the Falcon UI. What is the primary operational advantage provided by this framework to a Tier 1 responder?

A SOC Manager is reviewing the monthly efficiency of the incident response team. They are specifically analyzing how many alerts were handled by each individual analyst and the ratio of legitimate threats to noise to optimize staffing levels. While navigating the Detection Resolutions Dashboard, which of the following metrics would they NOT find, as it is primarily located within the Activity or Executive summary dashboards?

In various telemetry events like 'FileWrite' or 'NetworkConnect', Falcon identifies the process that performed the action. Which field will always identify this "acting" process?