CrowdStrike Falcon
CrowdStrike · Endpoint
Endpoint threat prevention, detection, investigation and containment
Endpoint protection and threat detection
Move from blocking known malware to detecting and containing hostile behaviour on every managed device.
The problem
“We need to see and stop attacks on our laptops and servers.”
Most intrusions reach an endpoint at some stage. If the only signal is an antivirus alert, the team knows a file was blocked but not whether the attacker already ran something else.
Coverage is usually uneven. Servers, remote laptops and virtual desktops end up with different agents, different policies and different visibility.
Proposed approach
- Step 1
Establish one endpoint agent standard
Inventory every device class and decide which products must cover each. Deploy a single detection and response agent where possible so telemetry and response actions work the same way everywhere.
- Step 2
Tune detection before widening enforcement
Start in detect-only mode on a pilot group, review the alerts with the team that will triage them, and adjust exclusions before enabling automatic blocking.
- Step 3
Script the first response step
Agree in advance when a host may be isolated and who approves it. Document the steps so containment does not depend on one person.
Implementation considerations
- Agent compatibility with operating systems and legacy applications
- Performance impact on engineering and virtual desktop workloads
- Change windows and rollout rings for servers
- Integration with the log platform and ticketing used by the SOC
Expected operational benefits
- Visibility into what happened on a host, not only that an alert fired
- Faster, more consistent containment
- One coverage standard that can be reported on
Products that address this
Products we work with for this requirement. Details are draft summaries pending vendor confirmation.
Palo Alto Networks Cortex
Palo Alto Networks · Monitoring
Cross-domain detection, investigation and automated response