CCFH-202b CrowdStrike Certified Falcon Hunter

The Host search (often accessed via the Host Investigate dashboard) is the primary "Host-Centric" investigation tool in the Falcon console. When an analyst enters a hostname or Agent ID (AID) into this tool, Falcon retrieves a consolidated view of that specific system's activity. One of the most critical sections of this dashboard is the Recent Logons list.

This view provides a chronological history of every user account—both local and domain—that has successfully authenticated to the host. For a hunter, this is an essential part of the Hunting Methodology for identifying "Credential Overlap" or unauthorized access. If an unusual administrative account or a service account that has no business being on that server is listed, it can indicate lateral movement (T1021). While User Search (Option C) allows you to see all the machines a specific user has touched, only Host search provides the "reverse" view: every user that has touched a specific machine . This allows the analyst to establish a baseline of "normal" users for a server (e.g., specific DBA accounts for a SQL server) and quickly spot anomalies that warrant a deeper dive into the UserLogon events in the Event Search.

To build effective and high-performance queries in Advanced Event Search , a hunter must have access to a definitive map of the telemetry captured by the sensor. The Falcon console docs serve as the primary repository for this information, specifically housing the Events Data Dictionary (also known as the Events Full Reference). This documentation is indispensable because it provides the technical specifications for every event type and field indexed within the platform.

Within the documentation, an analyst can find descriptions for fields like aid (Agent ID), aip (External IP), and the complex relationships between various Process IDs. Understanding these fields is critical for Hunting Analytics , as it prevents common errors, such as using a field that contains strings for a mathematical operation or confusing the ComputerName with the UserSid. Furthermore, the documentation often includes examples of how these fields are used in CrowdStrike Query Language (CQL) , allowing hunters to adapt existing templates to their specific needs. Relying on the official console documentation ensures that the hunter is using the most up-to-date definitions as new event types are added or existing ones are refined by CrowdStrike’s engineering teams, maintaining the accuracy and reliability of their investigations.