When a Linux host is in Reduced Functionality Mode (RFM) what telemetry and protection is still offered?
When a Linux host is in Reduced Functionality Mode (RFM) what telemetry and protection is still offered?
When a Linux host is in Reduced Functionality Mode (RFM), the sensor provides no protection and only collects Sensor Heart Beat events. This mode indicates that the sensor is still installed on the host but does not perform its usual detection and protection functions.
Linux sensors in RFM do very little, due to their strong dependency on the host's kernel. They don’t have detections or process execution events, but continue sending SensorHeartBeat events to indicate that a sensor is installed on the host.
It’s B.Search Reduced Functionality Mode for Linux Sensors in the support portal.
As Per the Documentation: Sensor Deployment and Maintenance > Sensor for Linux > Falcon Sensor for Linux Modes In Overview, the third dot point: Reduced functionality mode (RFM): If the Linux kernel is unsupported and doesn't meet user mode requirements, it enters RFM. Sensors in RFM don’t have detections or process events, but continue sending SensorHeartBeat events to indicate that a sensor is installed on the host.
A is correct
A correct, RFM = minimal protection