REAL TIME RESPONSE POLICIES

Question 1

How to apply roles and policy settings

Answer 1

Apply Policy Settings:

-Enable/disable individual response policy settings on Policy Details page

-Click Save to save settings

Question 2

How to track and review RTR audit logs to manage user activity?

Answer 2

–RTR activities are tracked and can be viewed in 3 audit logs in Falcon console
o Review the commands performed in each RTR session details
o See event history of maintenance performed on custom
scripts
o Files for “put command”

Question 3

What can be viewed in audit logs about RTR sessions?

Answer 3

• User who connected to host
• Host that was accessed
• Commands and arguments that were run
• Duration/Start time of session
• Files that were uploaded from host to CS cloud using the get
  command

Question 4

How to create a Response Policy

Answer 4

Create a Response Policy:

-Falcon Console > Configuration > Response Policies > Click Add New Policy > In New Policy Details dialog, enter policy name/description > Click “Create” to create policy