CCFR-201b Exam Question 16

What are Event Actions?
  • CCFR-201b Exam Question 17

    You can jump to a Process Timeline from many views, like a Hash Search, by clicking which of the following?
  • CCFR-201b Exam Question 18

    The primary purpose for running a Hash Search is to:
  • CCFR-201b Exam Question 19

    What information is contained within a Process Timeline?
  • CCFR-201b Exam Question 20

    After pivoting to an event search from a detection, you locate the ProcessRollup2 event. Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?