In Reduced Functionality Mode (RFM), what can the Falcon sensor only send?

In Reduced Functionality Mode (RFM), the Falcon sensor is specifically designed to operate under limitations that restrict its capabilities. During this mode, the sensor primarily focuses on sending heartbeats. Heartbeats serve as a fundamental means of communication between the sensor and the Falcon platform, allowing the system to confirm that the sensor is still active and capable of monitoring the endpoint despite the reduced functionality.

The heartbeats are essential as they help maintain a basic level of connectivity and status updates without overwhelming the network or the management console with increased data load. This mode is often implemented during periods of intensive resource usage or when the sensor is unable to function at full capacity due to various constraints.

In this context, the other options such as alerts and notifications, detailed logs, and real-time updates may not be sent in RFM due to the limitations imposed on the sensor’s functionality. Thus, the correct response accurately reflects what the Falcon sensor is capable of communicating while in Reduced Functionality Mode.