CrowdStrike Certified Falcon Administrator (CCFA): key terms

Flashcards for this exam CrowdStrike Certified Falcon Administrator (CCFA) guide

• Behavioral DetectionDetecting threats by analyzing actions and sequences of activity rather than static signatures.Intermediate
• CrowdStrike FalconCrowdStrike's cloud-native endpoint and XDR platform delivered through a single lightweight sensor.Intermediate
• Endpoint Detection and Response (EDR)Security software that continuously records endpoint activity, detects malicious behavior and enables investigation and response.Foundational
• Endpoint Protection Platform (EPP)An endpoint security solution focused on preventing threats with antimalware, firewall, device control and exploit prevention.Foundational
• Extended Detection and Response (XDR)A security platform that correlates telemetry across endpoints, network, cloud, identity and email for unified detection and response.Intermediate
• Host IsolationDisconnecting an endpoint from the network except for the security management channel to contain a threat.Foundational
• Indicator of Attack (IoA)Evidence of attacker behavior or intent in progress, focusing on techniques rather than specific artifacts.Intermediate
• Managed Detection and Response (MDR)An outsourced service providing 24x7 threat detection, investigation and active response using the provider's tools and analysts.Intermediate
• Next-Generation Antivirus (NGAV)Endpoint antimalware that uses machine learning, behavioral analysis and exploit prevention instead of relying solely on signatures.Foundational