Authentication Traffic Inspection (ATI) is a foundational capability of Falcon Identity Protection that enables the platform to analyze authentication traffic from domain controllers. According to the CCIS documentation, ATI is enabled throughIdentity configuration policies.
Identity configuration policies define how the Falcon sensor captures and inspects authentication-related traffic, including Kerberos, NTLM, LDAP, and other identity protocols. Enabling ATI at this level ensures that domain controllers provide the necessary telemetry for identity risk analysis, detections, and behavioral profiling.
The other options are incorrect because:
Identity management settings focus on identity governance and administration.
Identity detection configuration controls detection logic, not traffic inspection.
Identity protection settings manage high-level configuration but do not directly enable ATI.
Because ATI must be explicitly enabled viaIdentity configuration policies,Option Ais the correct and verified answer.
Submit