The MITRE-Based Falcon Detections Framework is a core component of the Falcon UI. What is the primary operational advantage provided by this framework to a Tier 1 responder?
A.
It allows for the automated decryption of files affected by ransomware.
B.
It provides a standardized view of the attack lifecycle to help understand adversary behavior.
C.
It enables the sensor to block kernel-level drivers from unknown publishers.
D.
It provides a real-time count of the total number of files on the endpoint.
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit