What happens when an active host is deleted within the CrowdStrike Falcon dashboard?

When an active host is deleted within the CrowdStrike Falcon dashboard, the correct outcome is that the host is moved to Trash but continues sending events. This process allows for a temporary removal of the host from the active list without losing the historical data or event information associated with it.

Moving the host to Trash means that while it is no longer considered an active or monitored host within the dashboard, it still retains its connection and can send events back to the Falcon platform. This feature is particularly beneficial for maintaining a view of past activities and for potential future investigations or compliance audits, as the data can still be analyzed even though the host itself is not actively managed.

In contrast to other options, where a host would either be permanently removed, quarantined, or disabled, the ability to continue receiving events while in Trash allows for ongoing monitoring of the host's activities even after its deletion from the main dashboard interface. This reflects a nuanced approach to host management, prioritizing data integrity and continued oversight.