Your CISO has decided all Falcon Analysts should also have the ability to view files and file contents locally on compromised hosts, but without the ability to take them off the host. What is the most appropriate role that can be added to fullfil this requirement?
To view files and file contents locally on compromised hosts without the ability to extract them, the 'Real Time Responder – Read Only Analyst' role is the most appropriate. This role grants permissions to run specific commands such as viewing file contents without permitting file extraction, which aligns with the requirement of being able to view files without the ability to take them off the host.
Questions is talking about viewing files and contents on managed hosts which is only possible using Real-Time Response (RTR).
@plantvast - but which one?
I think it would be Real Time Responder - Read Only Analyst. since the RTR admins are probably capable of everything with RTR and RTR Active Responder can extract files from the machine while in the question the ask not to.
B is the correct answer
I Agree, the B is the correct answer. The Falcon Analyst do not have any RTR permission, so it is not able to connect to any host or list files, of course the real time download of files is not allowed. The Real Time Responder - Read Only Analyst only allows to run the commands "cat,cd,clear,env,eventlog,filehash,getsid,help,history,ipconfig,ls,mount,netstat,ps,reg" the role do not have permission to get files so it is the most aproximated profile for the requested capabilities.
B is correct
to get into the system and see the files remotely you need RTR role
B.. confirmed in portal
B is correct, checked in the docs
B is correct answer
C Only correct. The question itsellf mentioned Falcon Analyst, he needed additional rights to view all logs. So Falcon Analyst- Read Only Correct
Also Falcon Analyst-Ready Only having more options then Real Time Responder-Read Only Analyst according to CrowdStrike Original Console note. You can Falcon Analyst-Read only as one more role. that's it.
checked