When detections are disabled for a host, the Falcon sensor on that endpoint stops creating and reporting new detection events to the CrowdStrike cloud. The DetectionSummaryEvent is the specific event type generated and sent via the Streaming API whenever a new detection occurs. Therefore, a direct impact on the API is that the stream of DetectionSummaryEvents for that particular host will cease until detections are re-enabled, as no new detections are being generated to trigger these events.

A. This is a true statement about the general effect on the host, but it is not the most specific answer regarding the impact on the API itself.

B. This is factually incorrect. Detections can be disabled for individual hosts or groups of hosts through the "Sensor Visibility Exclusions" feature in the Falcon console.

D. This is incorrect. Disabling detections is a persistent state that remains active until manually re-enabled; it does not have a default 24-hour time limit.

1. CrowdStrike

Inc. (2023). Falcon Event Streams Documentation. CrowdStrike Support Portal. In the "Event Dictionary" section

the DetectionSummaryEvent is defined as the event created when a new detection is triggered. Disabling detections on a host prevents this trigger condition.

2. CrowdStrike

Inc. (2023). Falcon Platform User Guide. CrowdStrike Support Portal. The "Host Management" chapter details the "Sensor Visibility Exclusions" feature

explaining that it can be applied to individual hosts to "suppress detection notifications

" which directly stops the creation of events that would be sent to the API.

3. CrowdStrike

Inc. (2023). CCFA-200b Falcon Administrator Courseware. Module: "Host and Sensor Management". This module explicitly covers the functionality of Sensor Visibility Exclusions

confirming that they can be applied to individual hosts and that their purpose is to stop the generation of new detections

which logically halts the corresponding API events.