You gave couple different answers, you commented A and C, then now you just post a link, but not directly related.
So what is the correct answer?
That question is : Custom IOA rules are defined using which syntax?
Don't waste your time, dude.
Answer A, A. Glob Syntax
Globs in the Falcon console
Glob wildcards offer flexibility when file names and directory structures vary across multiple hosts. For example, wildcards can match partial file names or match file names regardless of what directory they’re in.
Features that support globs:
Prevention policy exclusions. For more info, see Understanding prevention policy exclusions.
Falcon FileVantage file integrity monitoring rules and scheduled exclusions. For more info, see Falcon FileVantage.
Falcon Firewall wildcard IFN rules. For more info, see Manage your firewall rules and rule groups.
Falcon USB Device Control serial numbers used to create prevention policy exceptions. For more info, see USB Device Control.
Reference : In 2024, the Advanced event search will use the CrowdStrike Query Language (CQL).
Answer A, A. Glob Syntax
Globs in the Falcon console
Glob wildcards offer flexibility when file names and directory structures vary across multiple hosts. For example, wildcards can match partial file names or match file names regardless of what directory they’re in.
Features that support globs:
Prevention policy exclusions. For more info, see Understanding prevention policy exclusions.
Falcon FileVantage file integrity monitoring rules and scheduled exclusions. For more info, see Falcon FileVantage.
Falcon Firewall wildcard IFN rules. For more info, see Manage your firewall rules and rule groups.
Falcon USB Device Control serial numbers used to create prevention policy exceptions. For more info, see USB Device Control.
Reference : In 2024, the Advanced event search will use the CrowdStrike Query Language (CQL).
The correct answer for Sensor Visibility Exclusion patterns in Crowdstrike is:
C. RegEx (Regular Expressions)
https://www.crowdstrike.com/blog/tech-center/custom-ioas/
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
silva222222
1 month, 3 weeks agoalanalanalan
1 month, 2 weeks agoalanalanalan
1 month, 3 weeks agoalanalanalan
1 month, 3 weeks agosilva222222
1 month, 3 weeks agosilva222222
1 month, 3 weeks agoPipo12345
6 months, 3 weeks agoAcrby
6 months, 4 weeks agowildbandana
7 months agoe6cb31b
1 month, 3 weeks ago