CrowdStrike logo

CrowdStrike Falcon

CrowdStrike · Endpoint Detection and Response (EDR/XDR)

Cloud-delivered endpoint protection, detection and response from a single lightweight agent.

Request a consultationCompare products
Draft summary. This page summarises what the vendor's product family is generally known for. Each claim is pending confirmation against vendor documentation.

Overview

CrowdStrike Falcon protects laptops, servers and cloud workloads with one lightweight agent managed from a cloud console. It prevents known and unknown threats, records what processes and users did on each host, and lets analysts isolate a machine in seconds.

The platform extends beyond the endpoint with modules for identity threat protection, cloud security, threat intelligence, managed threat hunting and next-generation log management. Ten Forward is a CrowdStrike partner with certified engineers on staff.

Primary capability
Endpoint threat prevention, detection, investigation and containment
Deployment models
SaaSPending vendor confirmation
Agent-basedPending vendor confirmation
Management effort
ModeratePending vendor confirmation

Customer challenges and business value

  • Antivirus alerts without a story

    A blocked file does not show what ran before it. Analysts rebuild the timeline by hand across several tools.

  • Uneven coverage across devices

    Servers, remote laptops and virtual desktops end up with different agents and policies, so detection depends on which machine was hit.

  • Not enough people to hunt

    Few teams can watch for stealthy intrusions around the clock without help from a managed service.

What this helps you achieve

  • Faster path from first detection to containment
  • One agent and one console instead of several endpoint tools
  • Optional managed hunting for teams without a 24x7 SOC

Key capabilities

  • Next-generation antivirus with behavioural and machine-learning preventionPending vendor confirmation
  • Endpoint detection and response with full activity timelinesPending vendor confirmation
  • Remote host isolation and real-time response actionsPending vendor confirmation
  • Threat intelligence and adversary profiles built into detectionsPending vendor confirmation
  • Managed threat hunting and managed detection and response optionsPending vendor confirmation
  • Identity threat protection for Active Directory and cloud identityPending vendor confirmation
  • Cloud workload and container protectionPending vendor confirmation
  • Next-generation SIEM and log management modulePending vendor confirmation

Technical architecture and deployment

Where the product sits in a typical security architecture, and what it connects to.

Data sources

  • Laptops and desktops
  • Servers
  • Cloud workloads

This product

CrowdStrike Falcon platform

Outputs and actions

  • SIEM / SOAR
  • Case management
  • Response actions
Generic placement for this category. Actual data sources and integrations depend on the product and your environment.

Integration ecosystem

Categories of systems this type of product commonly connects to. Specific connectors and versions are confirmed with the vendor.

  • Identity providers and Active DirectoryPending vendor confirmation
  • SIEM and SOAR platformsPending vendor confirmation
  • Ticketing and case managementPending vendor confirmation
  • Cloud provider accountsPending vendor confirmation

Common use cases

  • Ransomware prevention and rapid host isolation
  • Investigating a suspected compromised laptop or server
  • Proactive threat hunting across endpoints
  • Replacing several legacy endpoint tools with one agent

Frequently asked questions

Is Falcon only an antivirus replacement?

No. Prevention is one module. The platform also records endpoint activity for investigation, supports response actions and offers identity, cloud and managed-service options. Which modules apply depends on the licence you choose.

Does it need on-premises servers?

The management console is cloud-delivered. The agent installs on each endpoint. Confirm connectivity and data residency requirements during scoping.

Where does the information on this page come from?

This page is a draft summary of what the vendor's product family is generally known for. Capabilities, deployment models and integrations are marked as pending until they are checked against vendor documentation. Ask us for a confirmed scope for your environment.

Talk to an expert about CrowdStrike Falcon

Share your environment and requirements. We will confirm product details with the vendor and help you decide.

Request a consultation