CrowdStrike Falcon Next-Gen SIEM for AWS (pay-as-you-go)

My main use case for CrowdStrike Falcon is endpoint detection. I want to ensure that all of our endpoints are protected and detect any malicious activity or any unauthorized activity on our endpoints for endpoint detection in my day-to-day work.

We have recently started using Identity Protection next to CrowdStrike Falcon EDR, We also use the next-gen SIEM a little bit, primarily during incidents to look for evidence on CrowdStrike.

We are not using AI much within CrowdStrike Falcon, apart from a little bit of Charlotte, but I am planning to explore that avenue further.

My use of CrowdStrike Falcon has expanded since the initial deployment with additions such as Identity Protection and firewalls.

Since implementing CrowdStrike Falcon, we do feel safer, as we detect unauthorized activities and can react quickly.

Although I do not have the numbers, I can say that when we have an incident, we see the processes, the graph, the timelines, and the adversary's actions, allowing us to make quick decisions and contain the device then and there.

Using CrowdStrike Falcon made our life much easier because we now have one place for the endpoints where we can go and find all the answers that we need.

We had an incident involving aphishing ; we looked at the files and discovered it was a Microsoft OneDrive link and users download the malicious file and executing a script. CrowdStrike Falcon not only prevented it but also helped us trace it back to that link, enabling us to understand where it came from, stopping access at that level, and preventing the script from running saved us massively.

We are a very small team, and CrowdStrike Falcon is a real help, with automation being a key factor that helps us leverage our limited resources to take more action despite having fewer people.

CrowdStrike Falcon offers very good protection, and I will see all the information in one place, which is quite handy and reliable.

When I say all the information is in one place, it helps us in practice because we see all the processes and activities on the endpoints related to an event or incident, and we can pivot to see more data by going deep into the data available and exported from the endpoint.

The detection capabilities are really good, as it understands the behavior of Windows machines, although it is not as great on Mac OS and Linux.

I really appreciate the identity part, which fits nicely with our endpoint detection using CrowdStrike Falcon EDR, and I see some benefits already from deploying it recently, allowing me to trace back from one identity to one endpoint and back again.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is that it understands detection and response exceptionally well, proven by its good telemetry collection and actionable insights, so I do not have to worry about creating detection rules, with fewer false positives than other platforms.

I think CrowdStrike Falcon UI is a little bit slow to react and they keep moving the options and modules. we have to jump from one module to another this is a real painn requiring multiple tabs open for investigations. It would be easier if it consolidated the information on one page instead of opening new tabs in the browser.

Session timeout bothers us because investigations sometimes take time, and when we jump to another platform to continue, our session expires and all of tabs are time out. If I have not tagged or saved them, I have to redo that work, which occurs quite often.

So far, I have mix feeling about Charlotte AI, sometimes makes mistakes and misses context, however it never forget to consume tokens, which affects its reliability.

CrowdStrike has expanded far beyond what we were used to in traditional securitydetection and response now it needs to be more easily accessible, and we should not have to jump into so many modules and hopes to complete an investigation

CrowdStrike Falcon itself does not pose a problem regarding endpoint performance; it reliable and doesn't spike the device performance. However, the device control related to USB blocking is a significant challenge for us, it defiantly requiring improvement, as it mistakenly disables usb cameras and is difficult to track in logs. CrowdStrike claims it has not blocked anything, yet the USB and camera non-functionality persists until removal of CrowdStrike.

I have used CrowdStrike Falcon since three years ago in my recent job, although I have used CrowdStrike Falcon well from my previous roles since 2018.

CrowdStrike Falcon is stable in my experience, with only one significant glitch and the persistent USB issue, but otherwise it works well.

CrowdStrike Falcon's scalability allows for easy scaling without issues.

Customer support with CrowdStrike is very poor; they often respond with scripted answers, as it has become an AI chat support system made it even worse. Overall, it does not provide a great experience, especially with sales and support staff not being attentive,

When you have issue take time to explain it to them and then they say ohh it's over 7 days we don't have logs. That usb issues, every time they ask for logs but nothing comes out of it. I have stopped raising issues it to them unless if we are really need them

We previously used another ePO EDR, ; it was challenging with detections and due to false positives. managing exclusions was time-consuming This inefficiency is why we made the switch.

CrowdStrike Falcon is deployed in our organization on a public cloud, where we have our own tenants.

No you can do it yourself, but spend time configuring all policies, integration and automation before leave it to run on it own

Although I cannot provide solid metrics on return on investment, I can say that I have a small team and definitely need CrowdStrike Falcon, so I cannot get away from it.

We have an enterprise contract, as the parent company purchased CrowdStrike.

It is really good to have multiple capabilities on a single platform, but when they are fragmented into different modules and sold at a very expensive rate, people end up having one or two modules and miss out on the holistic approach that CrowdStrike Falcon offers. I think an endpoint should be an endpoint, regardless of being in the cloud or on-prem, Crowdstrike consider a container a different cost, so is the cloud, and endpoints, and mobile; this approach makes it difficult as we have to pick and choose. That's not included other modules,

I believe those that are related to security operation and detection and reaponse all should be part of same package, although I understand some modules such as AI, cloud config posture, and vulnerability can be different

Licensing is a real challenge with CrowdStrike Falcon, as it is the main reason that makes us reconsider moving further with it new capabilities.

Defender was another option we considered. We found Crowdstrike was much easier to work with and navigate and information were presented much clearer.

I rate it an eight because, it's a very high and respectable number, in terms of technology, CrowdStrike Falcon focus primarily at endpoints, believing everything evolves from there. However, we do have network activities that CrowdStrike Falcon does not account for, which makes it a bit difficult to rate it a ten; it is not all-encompassing, but it is really good.

The AI capabilities of CrowdStrike Falcon are new, so I need to use this to get more insight. From what I have seen, it is interesting, but I will see how it evolves.

I have not consolidated or replaced other security tools with CrowdStrike Falcon, as not much has been done in that area.

My advice for others looking into using CrowdStrike Falcon is to invest time and money to customise the platform so that it can work cohesively across different modules, ensuring it is not just a single alerting tool but rather an integrated system that correlates data and reaponse across the enterprise.

My main use case for CrowdStrike Falcon is for endpoint detection and EDR.

A quick specific example of how I use CrowdStrike Falcon for endpoint detection is that data from Falcon comes to SecOps as an alert, and then I go back to CrowdStrike to search for whatever detection it has made, and I use containment or remediation methods or conduct further deep dive searches.

CrowdStrike Falcon has positively impacted my organization by helping me achieve more true positive detections, reducing false positives, and making it much easier and quicker to take containment and remediation steps.

I would say false positives have reduced by about 30%, and my team is able to respond much quicker now.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats by making navigation easier and helping me reduce true positives and the number of alerts.

CrowdStrike Falcon has reduced the workload of my security team overall, although some deployments are still ongoing.

The best features that CrowdStrike Falcon offers include the search feature, which is really nice, and the global search, where I can search anything, along with the advanced hunting feature that allows me to deep dive into anything at all.

When I mention the global search and advanced hunting features, they help me in my work because, for example, when I get an IP and have no idea which host that IP belongs to, I go to the global search, find the IP, and from there I can navigate to either host management, IP management, or further.

Regarding the advanced hunting feature, it also allows me to deep dive into searches even if I am not sure what I am looking for, which means I do not have to scroll through a lot of dashboards; I can get everything summarized.

I think CrowdStrike Falcon's accuracy and reliability of output are really good, as I have been getting the data and output I need.

Having multiple security capabilities on a single platform becomes much easier to navigate through, allowing me to correlate data and deploy it easily within the environment.

CrowdStrike Falcon differentiates itself from other cybersecurity platforms I have used because there is so much data consolidated into one tool, along with various features and additional tools I can integrate.

CrowdStrike Falcon can be improved as I have the Agent DKAI, the new feature that I would like to explore more; however, sometimes there is so much data that it becomes difficult to navigate through it and find the exact information I am looking for.

I have been using CrowdStrike Falcon for almost six months.

CrowdStrike Falcon is stable.

Customer support for CrowdStrike Falcon is good; they are very handy, help me expand, and are always available whenever help is needed.

I would rate customer support an eight on a scale of one to ten.

I replaced Carbon Black with CrowdStrike Falcon for EDR, which has helped me reduce false positive rates and other issues.

I used to use Carbon Black, but the switch was management's decision.

I would definitely say I have saved time since my group consists of only four people.

I rate CrowdStrike Falcon an eight out of ten.

I chose eight out of ten because there are still a few things that can be improved.

My recommendation to others reading reviews on PeerSpot is to explore more than just EDR; they can also look into the Agent DKAI, the new tool, and the Guardian feature as well.

My main use case for CrowdStrike Falcon is endpoint protection.

I basically use CrowdStrike Falcon to counter ransomware and all types of modern attacks, as I believe it has the capability to defend against the latest threats and also from APTs.

I think CrowdStrike Falcon is pretty lightweight, but very powerful considering its lightweight size, so it is very good for my environment and basically it is a very good product.

My use of CrowdStrike Falcon platform has not really expanded yet, but I like what I am using.

CrowdStrike Falcon has positively impacted my organization by boosting my overall defense on endpoint security, as I previously relied on traditional antivirus, which I do not think could keep up with modern threats anymore.

Since switching to CrowdStrike Falcon, I have noticed outcomes such as being able to really look at my risk posture and be more proactive rather than reactive.

Using CrowdStrike Falcon platform has changed the way my security team detects, investigates, and responds to threats as it basically provides more information into the event, so we do not have to go to other systems to fetch that data. In the past, I had to look in many different places to get the context of the event, but now I only have to look in CrowdStrike Falcon.

Having multiple security capabilities on a single platform in CrowdStrike Falcon definitely saves time and makes it more efficient, more effective, and gives us a head start when an incident breaks out.

The value of having endpoint identity, cloud, and other security telemetry in CrowdStrike Falcon platform is that it is very good being a one-stop shop where I can find most of the information I need when I am doing incident response and also my daily security operations.

CrowdStrike Falcon has made my job easier to some extent, but it is basically a better tool that I am using.

In my experience, the best features CrowdStrike Falcon offers are visibility and protection, and also comprehensive information on the assets.

The visibility feature of CrowdStrike Falcon helps me day-to-day by giving me very good visibility into the assets that it manages, so when I am looking at incidents or investigating events, I get a better understanding of the context. For example, I can see who is using the computer, who was logged in at the time, and what processes were run on the endpoint.

CrowdStrike Falcon sensor has really little impact on endpoint performance, and that is what I appreciate about it.

The console of CrowdStrike Falcon is a little bit too overwhelming for beginners, so if it could be a little bit more intuitive, that would be a great improvement.

I have been using CrowdStrike Falcon for more than two years.

CrowdStrike Falcon is very stable.

CrowdStrike Falcon has pretty easy scalability, so it has good scalability.

Customer support for CrowdStrike Falcon is great, and I find it wonderful.

On a scale of one to ten, I would rate the customer support an eight.

My experience with pricing, setup cost, and licensing was that it was very easy and very smooth.

CrowdStrike Falcon did not allow me to consolidate or replace other security tools.