Reference
Endpoint Detection & Response glossary
Terms used in Endpoint Detection & Response and its documentation.
Applies to Endpoint Detection & Response as it works today. Moraph updates the platform continuously, and this page is reviewed when it changes.
Terms used in Endpoint Detection & Response and its documentation.
| Term | Meaning |
|---|---|
| Falcon sensor | The CrowdStrike agent installed on each workstation or server that records activity and blocks known threats. |
| Host group | A set of machines that share prevention, update and containment settings, such as teller workstations or payment servers. |
| Detection | An alert raised by Falcon about suspicious or malicious activity on a machine, which a Moraph analyst triages. |
| Incident | A detection or set of detections confirmed as needing response, recorded with its timeline, affected machines and actions. |
| Network containment | Cutting a machine off from the network, except its connection to Falcon, so an attack cannot spread while it is investigated. |
| Containment policy | The written rules you approve that say which actions Moraph may take on which host groups without calling you first. |
| Detect-only mode | A prevention setting where Falcon reports malicious behavior but does not block it. |
| Exclusion | An approved rule that stops Falcon raising detections for a specific legitimate application or file path. |
| Threat hunt | A search through Falcon telemetry by an analyst for attacker activity that did not raise a detection. |
| Stale sensor | A sensor that has not reported to Falcon recently, which usually means the machine is off, disconnected or the sensor is broken. |
Was this page helpful?
Report a problem with this page
Need help with your own setup rather than this page? Raise a support ticket.