CrowdStrike Falcon
Cloud delivered endpoint, identity and cloud security platform combining next gen AV, EDR, threat intelligence and optional managed detection to reduce dwell time and stop breaches.
Overview
Falcon uses a lightweight agent and cloud analytics to detect and respond to attacks across endpoints, identities and cloud workloads. Telemetry is mapped to behaviors, threat intelligence enriches alerts and responders can isolate hosts, collect evidence and remediate remotely. Optional modules extend coverage to identity protection, exposure management, cloud workload security and log scale.
Integrations connect to SIEM and SOAR for automation, and managed detection services provide 24 by 7 coverage. Pricing is sold by quote with bundles for different organization sizes.
Key features
- Single lightweight agent with cloud analytics
- EDR detections and rapid remote response
- Threat intel with adversary profiles and TTPs
- Identity and cloud workload protection modules
- API and SIEM SOAR integrations
- Managed detection for 24x7 monitoring
- Dashboards and executive reporting
- Flexible bundles for SMB and enterprise
Best for
- Endpoint detection and response at scale
- Identity threat detection and lateral movement control
- Cloud workload and container protection
- Threat hunting and incident response
- Automation of common SOC actions via API
- Executive posture reporting for audits
- Remote remediation during incidents
- Program consolidation from multiple tools
Capabilities
Next Gen AV and EDR
Block known malware and detect suspicious behaviors, investigate timelines and quarantine hosts to stop spread.
Threat Intel and Behaviors
Use mapped behaviors and adversary intelligence to hunt, pivot and prioritize alerts with higher fidelity.
Identity and Cloud
Add identity protection and cloud workload coverage to reduce lateral movement and blind spots.
Managed Detection
Leverage 24x7 monitoring and guided response when internal coverage is limited or unavailable.
Frequently Asked Questions
Is pricing published?
Pricing is sales led and varies by bundle, seat count and modules; public list prices are not typically shown.
Can deployment start small?
Organizations often begin with core EDR and add identity or cloud modules as needs grow.
Does Falcon replace a SIEM?
Falcon integrates with SIEM and SOAR; many teams keep SIEM for compliance and correlation.
How heavy is the agent?
The agent is designed to be lightweight with analytics handled in the cloud.
Is MDR required?
Managed detection is optional and can be added for around the clock monitoring.
What operating systems are supported?
Windows, macOS and Linux are supported; cloud modules extend to containers and workloads.
Can response actions be automated?
Yes, APIs and integrations allow scripted isolation, notifications and ticketing.
What reporting exists for auditors?
Dashboards and exports support compliance reviews and executive updates.
Tags
Compare CrowdStrike Falcon
Side by side with the tools people weigh it against.
