USER MANAGEMENT

Question 1

Describe capabilities of RTR Read Only Analyst role?

Answer 1

-RTR Read Only Analyst - Can run a core set of read-only response commands to perform reconnaissance

Question 2

How to create a new user

Answer 2

Falcon Menu> Host setup and Management> Falcon Users > User Management > Input domain email/ First name/ Last Name/ Role

**To add users, you must have an administrative role for your Falcon subscription (Falcon Administrator or Falcon Intel Admin).

Question 3

How to delete a user

Answer 3

Click on Falcon > Falcon Users > User Management > Additional Actions > Delete user

**Must have an administrative role for your Falcon subscription (Falcon Administrator or Falcon Intel Admin).

Question 4

How to edit a user

Answer 4

Falcon Menu> Host setup and Management> Falcon Users > User Management

• Edit User name – make changes to the user’s first and last
  name – a user’s email address can NOT be modified
• Click > Additional Actions to Reset 2 factor authentication,
  reset passwords, or delete user
• Click > Assign Roles to assign one or more new roles to the
  user, or remove a role

Question 5

What does RTR do?

Answer 5

Real Time Response: Runs commands on Windows, Mac, Linux host directly from Falcon Console and can remotely connect to host from any location.

Question 6

What capabilities does RTR provide Windows hosts?

Answer 6

• Retrieve memory dumps
• Query, create or modify registry keys
• Collect diagnostic logs and stateful information about a
  host

Question 7

What are some of the remediation tasks that RTR can perform?

Answer 7

RTR can perform many common response and remediation tasks:
- List running processes and kill processes
- Show network connections
- Navigate the file system, get or delete files, and perform many
file system operations
- Upload files
- Remotely restart or shut down a host
- Manage and run your own custom scripts or executables

Question 8

Describe the capabilities of RTR Active Responder role?

Answer 8

RTR Active Responder - Can run all of the commands RTR Read Only Analyst can and more, including the ability to: extract files using the get command, run commands that modify the state of the remote host, and run certain custom scripts

Question 9

Describe the capabilities of RTR Administrator role?

Answer 9

RTR Administrator - Can do everything RTR Active Responder can do, plus create custom scripts, upload files to hosts using the put command, and directly run executables using the run command

Question 10

What determines a user’s permissions in the falcon console?

Answer 10

users role

Question 11

How to manage user roles?

Answer 11

falcon menu> Host setup and management> Falcon users> User management>locate the user you want to manage>select 3 dots>view user details>assign roles>select roles as necessary> assign

Question 12

To get falcon setup, what must be created?

Answer 12

Falcon admins