OB SLIDE PRESENTATION QUESTIONS

Question 1

Can we modify the Playbook for Detection Responses?
(customer that doesn’t care about Warranty so asks to make everything custom)

Answer 1

?

Question 2

Why may Time to Live vary?

Answer 2

?

Question 3

What is OverWatch?

Answer 3

CrowdStrikes Threat Hunting Team. Provides 24/7 support to stop hidden and advanced attacks.

Question 4

RFM covered by Warranty?

Question 5

If i have some in Cautious would that mean my entire account has no warranty

Answer 5

yes,

Question 6

Deployment help?

Answer 6

deployment is on your and your teams play, however if you run into trouble then we can create a support ticket

Question 7

What is System Assignment

Answer 7

?

Question 8

How long should I be in Cautious policy?

Answer 8

the less amount as time as possible is recommended

Question 9

How long does FC take to go live?

Answer 9

1 week

Question 10

How can I provide you my current exclusion list from Symantec?

Question 11

What happens when my email gets compromised?

Question 12

Will keep calling until someone answers for Critical escalations?

Answer 12

Yes. Everyone that will be contacted will be in order of precedence by the Appendix B document.

Question 13

SA will monitor the RFM?

Answer 13

?

Question 14

What’s a “Incident” ?

Answer 14

swat team vs detectives. we prevent incidents in real time and not going back to historically analyze any items and

Question 15

Call for Only “Critical Detection? For every Critical Detection”?

Answer 15

?

Question 16

Phone call for every Critical Detection?

Answer 16

?

Question 17

What if I have Falcon Mobile, what user permission do I need?

Answer 17

?

Question 18

CoinMinner for PUP??

Answer 18

?

Question 19

Couple weeks notice for Pen testing notice…????

Answer 19

if thats the case Falcon will continue to run as normal and if you would like to make any modifications let us know to action or not action.

Question 20

I was told that we can keep our current AV?

Answer 20

caution them from running side by side could cause performance issues or take action over the other and cause operational issues. However it is recommended to not run your current AV be side by side with Falcon Complete

Question 21

Active - no prod servers????

Answer 21

?

Question 22

Postures - Cautious for New customers with AVs?

Answer 22

Its good to maintain to avoid triggering the AV until full Falcon Complete has been integrated on your hosts.

Question 23

Response SLA - ?

Answer 23

?