You are tasked with generating a custom report in CrowdStrike to assist in planning a risk mitigation strategy. The report must focus on accounts exhibiting high-risk behaviors, such as excessive failed logins or abnormal activity patterns. Which configuration would best achieve this goal?
During a security review, a CrowdStrike Falcon Identity Threat Detection alert is triggered for a high-risk user attempting to access a sensitive application from an unusual geographic location. As a security analyst, you need to investigate the incident further using available pivots in the CrowdStrike console. Which of the following actions is the most appropriate first step for an identity-based investigation?