CrowdStrike Falcon
CrowdStrike · Endpoint
Endpoint threat prevention, detection, investigation and containment
Incident response and threat intelligence
Prepare for incidents, call in specialists when one happens, and use intelligence about the attackers who target you.
The problem
“We need experts and intelligence ready before and during a breach.”
Most teams have never handled a major breach. The first hours decide how much damage is done, yet roles, contacts and evidence handling are often undecided.
Generic threat feeds list indicators but rarely explain who is targeting your sector, how they work and what to change.
Proposed approach
- Step 1
Agree an incident response plan and retainer
Write down roles, decision rights and contacts, and arrange outside specialists in advance so no time is lost choosing a provider mid-incident.
- Step 2
Practise with tabletop and technical exercises
Rehearse scenarios with leadership and technical staff, and fix the gaps the exercise exposes.
- Step 3
Feed intelligence into detection
Use intelligence about relevant attacker groups to tune detections and prioritise defences, and review it regularly.
Implementation considerations
- Legal, regulatory and notification obligations
- Evidence handling and log retention
- Which systems the specialists may access during an incident
- In-house, retainer or managed service model
Expected operational benefits
- Faster, calmer response when an incident happens
- Leadership that has rehearsed its role
- Detection tuned to attackers relevant to your sector
Products that address this
Products we work with for this requirement. Details are draft summaries pending vendor confirmation.
Mandiant Threat Intelligence and Incident Response
Mandiant (Google Cloud) · Monitoring
Incident response, threat intelligence and managed defence