What happens when a hash is allowlisted?

What happens when a hash is allowlisted?
A . Execution is prevented, but detection alerts are suppressed
B . Execution is allowed on all hosts, including all other Falcon customers
C . The hash is submitted for approval to be allowed to execute once confirmed by Falcon specialists
D . Execution is allowed on all hosts that fall under the organization’s CID

View Answer

Answer: D

Explanation:

According to the CrowdStrike Falcon® Data Replicator (FDR) Add-on for Splunk Guide, the allowlist feature allows you to exclude files or directories from being scanned or blocked by CrowdStrike’s machine learning engine or indicators of attack (IOAs)2. This can reduce false positives and improve performance2. When you allowlist a hash, you are allowing that file to execute on any host that belongs to your organization’s CID (customer ID)2. This does not affect other Falcon customers or hosts outside your CID2.