Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?

After pivoting to an event search from a detection, you locate the ProcessRollup2 event.

Which two field values are you required to obtain to perform a Process Timeline search so you can determine what the process was doing?
A . SHA256 and TargetProcessld_decimal
B . SHA256 and ParentProcessld_decimal
C . aid and ParentProcessld_decimal
D . aid and TargetProcessld_decimal

View Answer

Answer: D

Explanation:

According to the CrowdStrike Falcon Devices Add-on for Splunk Installation and Configuration Guide v3.1.5+, the Process Timeline search requires two parameters: aid (agent ID) and TargetProcessId_decimal (the decimal value of the process ID). These fields can be obtained from the ProcessRollup2 event, which contains information about processes that have executed on a host1.