CrowdStrike Falcon Next-Gen SIEM for AWS (pay-as-you-go)

My main use case for CrowdStrike Falcon is endpoint detection. I want to ensure that all of our endpoints are protected and detect any malicious activity or any unauthorized activity on our endpoints for endpoint detection in my day-to-day work.

We have recently started using Identity Protection next to CrowdStrike Falcon EDR, We also use the next-gen SIEM a little bit, primarily during incidents to look for evidence on CrowdStrike.

We are not using AI much within CrowdStrike Falcon, apart from a little bit of Charlotte, but I am planning to explore that avenue further.

My use of CrowdStrike Falcon has expanded since the initial deployment with additions such as Identity Protection and firewalls.

Since implementing CrowdStrike Falcon, we do feel safer, as we detect unauthorized activities and can react quickly.

Although I do not have the numbers, I can say that when we have an incident, we see the processes, the graph, the timelines, and the adversary's actions, allowing us to make quick decisions and contain the device then and there.

Using CrowdStrike Falcon made our life much easier because we now have one place for the endpoints where we can go and find all the answers that we need.

We had an incident involving aphishing ; we looked at the files and discovered it was a Microsoft OneDrive link and users download the malicious file and executing a script. CrowdStrike Falcon not only prevented it but also helped us trace it back to that link, enabling us to understand where it came from, stopping access at that level, and preventing the script from running saved us massively.

We are a very small team, and CrowdStrike Falcon is a real help, with automation being a key factor that helps us leverage our limited resources to take more action despite having fewer people.

CrowdStrike Falcon offers very good protection, and I will see all the information in one place, which is quite handy and reliable.

When I say all the information is in one place, it helps us in practice because we see all the processes and activities on the endpoints related to an event or incident, and we can pivot to see more data by going deep into the data available and exported from the endpoint.

The detection capabilities are really good, as it understands the behavior of Windows machines, although it is not as great on Mac OS and Linux.

I really appreciate the identity part, which fits nicely with our endpoint detection using CrowdStrike Falcon EDR, and I see some benefits already from deploying it recently, allowing me to trace back from one identity to one endpoint and back again.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is that it understands detection and response exceptionally well, proven by its good telemetry collection and actionable insights, so I do not have to worry about creating detection rules, with fewer false positives than other platforms.

I think CrowdStrike Falcon UI is a little bit slow to react and they keep moving the options and modules. we have to jump from one module to another this is a real painn requiring multiple tabs open for investigations. It would be easier if it consolidated the information on one page instead of opening new tabs in the browser.

Session timeout bothers us because investigations sometimes take time, and when we jump to another platform to continue, our session expires and all of tabs are time out. If I have not tagged or saved them, I have to redo that work, which occurs quite often.

So far, I have mix feeling about Charlotte AI, sometimes makes mistakes and misses context, however it never forget to consume tokens, which affects its reliability.

CrowdStrike has expanded far beyond what we were used to in traditional securitydetection and response now it needs to be more easily accessible, and we should not have to jump into so many modules and hopes to complete an investigation

CrowdStrike Falcon itself does not pose a problem regarding endpoint performance; it reliable and doesn't spike the device performance. However, the device control related to USB blocking is a significant challenge for us, it defiantly requiring improvement, as it mistakenly disables usb cameras and is difficult to track in logs. CrowdStrike claims it has not blocked anything, yet the USB and camera non-functionality persists until removal of CrowdStrike.

I have used CrowdStrike Falcon since three years ago in my recent job, although I have used CrowdStrike Falcon well from my previous roles since 2018.

CrowdStrike Falcon is stable in my experience, with only one significant glitch and the persistent USB issue, but otherwise it works well.

CrowdStrike Falcon's scalability allows for easy scaling without issues.

Customer support with CrowdStrike is very poor; they often respond with scripted answers, as it has become an AI chat support system made it even worse. Overall, it does not provide a great experience, especially with sales and support staff not being attentive,

When you have issue take time to explain it to them and then they say ohh it's over 7 days we don't have logs. That usb issues, every time they ask for logs but nothing comes out of it. I have stopped raising issues it to them unless if we are really need them

We previously used another ePO EDR, ; it was challenging with detections and due to false positives. managing exclusions was time-consuming This inefficiency is why we made the switch.

CrowdStrike Falcon is deployed in our organization on a public cloud, where we have our own tenants.

No you can do it yourself, but spend time configuring all policies, integration and automation before leave it to run on it own

Although I cannot provide solid metrics on return on investment, I can say that I have a small team and definitely need CrowdStrike Falcon, so I cannot get away from it.

We have an enterprise contract, as the parent company purchased CrowdStrike.

It is really good to have multiple capabilities on a single platform, but when they are fragmented into different modules and sold at a very expensive rate, people end up having one or two modules and miss out on the holistic approach that CrowdStrike Falcon offers. I think an endpoint should be an endpoint, regardless of being in the cloud or on-prem, Crowdstrike consider a container a different cost, so is the cloud, and endpoints, and mobile; this approach makes it difficult as we have to pick and choose. That's not included other modules,

I believe those that are related to security operation and detection and reaponse all should be part of same package, although I understand some modules such as AI, cloud config posture, and vulnerability can be different

Licensing is a real challenge with CrowdStrike Falcon, as it is the main reason that makes us reconsider moving further with it new capabilities.

Defender was another option we considered. We found Crowdstrike was much easier to work with and navigate and information were presented much clearer.

I rate it an eight because, it's a very high and respectable number, in terms of technology, CrowdStrike Falcon focus primarily at endpoints, believing everything evolves from there. However, we do have network activities that CrowdStrike Falcon does not account for, which makes it a bit difficult to rate it a ten; it is not all-encompassing, but it is really good.

The AI capabilities of CrowdStrike Falcon are new, so I need to use this to get more insight. From what I have seen, it is interesting, but I will see how it evolves.

I have not consolidated or replaced other security tools with CrowdStrike Falcon, as not much has been done in that area.

My advice for others looking into using CrowdStrike Falcon is to invest time and money to customise the platform so that it can work cohesively across different modules, ensuring it is not just a single alerting tool but rather an integrated system that correlates data and reaponse across the enterprise.

My main use case for CrowdStrike Falcon is for endpoint detection and EDR.

A quick specific example of how I use CrowdStrike Falcon for endpoint detection is that data from Falcon comes to SecOps as an alert, and then I go back to CrowdStrike to search for whatever detection it has made, and I use containment or remediation methods or conduct further deep dive searches.

CrowdStrike Falcon has positively impacted my organization by helping me achieve more true positive detections, reducing false positives, and making it much easier and quicker to take containment and remediation steps.

I would say false positives have reduced by about 30%, and my team is able to respond much quicker now.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats by making navigation easier and helping me reduce true positives and the number of alerts.

CrowdStrike Falcon has reduced the workload of my security team overall, although some deployments are still ongoing.

The best features that CrowdStrike Falcon offers include the search feature, which is really nice, and the global search, where I can search anything, along with the advanced hunting feature that allows me to deep dive into anything at all.

When I mention the global search and advanced hunting features, they help me in my work because, for example, when I get an IP and have no idea which host that IP belongs to, I go to the global search, find the IP, and from there I can navigate to either host management, IP management, or further.

Regarding the advanced hunting feature, it also allows me to deep dive into searches even if I am not sure what I am looking for, which means I do not have to scroll through a lot of dashboards; I can get everything summarized.

I think CrowdStrike Falcon's accuracy and reliability of output are really good, as I have been getting the data and output I need.

Having multiple security capabilities on a single platform becomes much easier to navigate through, allowing me to correlate data and deploy it easily within the environment.

CrowdStrike Falcon differentiates itself from other cybersecurity platforms I have used because there is so much data consolidated into one tool, along with various features and additional tools I can integrate.

CrowdStrike Falcon can be improved as I have the Agent DKAI, the new feature that I would like to explore more; however, sometimes there is so much data that it becomes difficult to navigate through it and find the exact information I am looking for.

I have been using CrowdStrike Falcon for almost six months.

CrowdStrike Falcon is stable.

Customer support for CrowdStrike Falcon is good; they are very handy, help me expand, and are always available whenever help is needed.

I would rate customer support an eight on a scale of one to ten.

I replaced Carbon Black with CrowdStrike Falcon for EDR, which has helped me reduce false positive rates and other issues.

I used to use Carbon Black, but the switch was management's decision.

I would definitely say I have saved time since my group consists of only four people.

I rate CrowdStrike Falcon an eight out of ten.

I chose eight out of ten because there are still a few things that can be improved.

My recommendation to others reading reviews on PeerSpot is to explore more than just EDR; they can also look into the Agent DKAI, the new tool, and the Guardian feature as well.

My main use case for CrowdStrike Falcon is endpoint protection.

I basically use CrowdStrike Falcon to counter ransomware and all types of modern attacks, as I believe it has the capability to defend against the latest threats and also from APTs.

I think CrowdStrike Falcon is pretty lightweight, but very powerful considering its lightweight size, so it is very good for my environment and basically it is a very good product.

My use of CrowdStrike Falcon platform has not really expanded yet, but I like what I am using.

CrowdStrike Falcon has positively impacted my organization by boosting my overall defense on endpoint security, as I previously relied on traditional antivirus, which I do not think could keep up with modern threats anymore.

Since switching to CrowdStrike Falcon, I have noticed outcomes such as being able to really look at my risk posture and be more proactive rather than reactive.

Using CrowdStrike Falcon platform has changed the way my security team detects, investigates, and responds to threats as it basically provides more information into the event, so we do not have to go to other systems to fetch that data. In the past, I had to look in many different places to get the context of the event, but now I only have to look in CrowdStrike Falcon.

Having multiple security capabilities on a single platform in CrowdStrike Falcon definitely saves time and makes it more efficient, more effective, and gives us a head start when an incident breaks out.

The value of having endpoint identity, cloud, and other security telemetry in CrowdStrike Falcon platform is that it is very good being a one-stop shop where I can find most of the information I need when I am doing incident response and also my daily security operations.

CrowdStrike Falcon has made my job easier to some extent, but it is basically a better tool that I am using.

In my experience, the best features CrowdStrike Falcon offers are visibility and protection, and also comprehensive information on the assets.

The visibility feature of CrowdStrike Falcon helps me day-to-day by giving me very good visibility into the assets that it manages, so when I am looking at incidents or investigating events, I get a better understanding of the context. For example, I can see who is using the computer, who was logged in at the time, and what processes were run on the endpoint.

CrowdStrike Falcon sensor has really little impact on endpoint performance, and that is what I appreciate about it.

The console of CrowdStrike Falcon is a little bit too overwhelming for beginners, so if it could be a little bit more intuitive, that would be a great improvement.

I have been using CrowdStrike Falcon for more than two years.

CrowdStrike Falcon is very stable.

CrowdStrike Falcon has pretty easy scalability, so it has good scalability.

Customer support for CrowdStrike Falcon is great, and I find it wonderful.

On a scale of one to ten, I would rate the customer support an eight.

My experience with pricing, setup cost, and licensing was that it was very easy and very smooth.

CrowdStrike Falcon did not allow me to consolidate or replace other security tools.

My main use case for CrowdStrike Falcon is endpoint security across all assets. In my daily work, all our assets and hosts, regardless of the platform, have a Falcon sensor installed.

CrowdStrike Falcon has had a positive impact on my company by providing higher visibility of our assets and delivering insights into the state of the assets. The increased visibility and insights have led to measurable improvements, such as faster response times, and policies can be deployed via the Falcon sensor.

CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats by allowing us to become much faster in a preventive way, enabling us to take measures much more quickly that already prevent attacks in advance.

CrowdStrike Falcon has affected the workload and productivity of my security team by allowing us to become much more productive.

The best features that CrowdStrike Falcon offers are easy deployment of the Falcon sensor across all platforms, automation capabilities, and the capability to isolate assets when needed. I would also like to highlight blocking USB ports as another feature that I particularly appreciate.

I assess the governance and security regarding the AI capabilities of CrowdStrike Falcon as good. I rate the accuracy and reliability of the AI outputs in CrowdStrike Falcon highly since the model is specifically trained on the use case with the data.

The advantages I see in combining multiple security functions on a single platform include not having to think in terms of multiple solutions and switch between them, having all the data in one place, achieving more consistent visibility of events from cloud to on-premises, having better traceability for alerting, and being able to correlate data better.

The value I see in having endpoint, identity, cloud, and other security telemetry brought together in CrowdStrike Falcon is that I can follow the entire history and better recognize attack paths instead of just seeing individual events.

What distinguishes CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is its more holistic view, as it is not just focused on a single domain but covers everything due to the large number of modules.

CrowdStrike Falcon could be improved because fine-grained access is not yet implemented deeply enough in all areas, making it difficult to give our IT employees full access to CrowdStrike Falcon without seeing too much.

I have been using CrowdStrike Falcon personally since April 2026.

The Falcon sensor has had no impact on the performance of my endpoints and my ability to implement security at scale. CrowdStrike Falcon is stable.

I rate the scalability of CrowdStrike Falcon as very good.

I find the customer service of CrowdStrike Falcon to be very friendly and very fast. I would rate the customer service as a 10 on a scale from 1 to 10.

I rate CrowdStrike Falcon a 10 on a scale from 1 to 10. The main reason I chose a 10 is that it is easy to handle, and the benefit for us as an information security department is enormous.

Since the initial rollout, my use of CrowdStrike Falcon has evolved significantly with many more features added, a clearer presentation, and UI adjustments.

The advice I would give to others who are considering CrowdStrike Falcon is to check as many functions as possible and then use several things simultaneously.

My main use case for CrowdStrike Falcon is endpoint security. A concrete example of this is querying vulnerabilities and handling detections.

My use of CrowdStrike Falcon has changed and expanded since it was first introduced in the company. The platform has developed to include new areas and functions such as Cloud Security Exposure Management, Falcon for IT, and Falcon for Mobile.

CrowdStrike Falcon has had a positive impact on my company by providing a better overview of all assets, vulnerabilities, and installation status.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats. Through API integration, work has become faster and more successful, and the data from CrowdStrike is very accurate.

The best features that CrowdStrike Falcon offers are the alerting, the API integration, and vulnerability management.

These features support my daily work by giving us a better overview of all vulnerabilities, which we can pass on via API if necessary to various departments. The alerting via the SOC is very helpful.

I consider the accuracy and reliability of the results I have obtained through CrowdStrike Falcon's AI features to be very accurate.

The advantages I see in consolidating several security functions on a single platform are that you have a single source of truth. The added value in having endpoint, identity, cloud, and other security telemetry brought together in CrowdStrike Falcon is that CrowdStrike is currently positioned in the best possible way.

What sets CrowdStrike Falcon apart from other cybersecurity platforms I have used or evaluated is that it is more advanced and easier to use.

CrowdStrike Falcon could be improved with better and clearer API documentation.

I have been using CrowdStrike Falcon for three years.

The Falcon sensor affects the performance of my endpoints positively, as I don't notice any poor performance, and the performance is great, meaning security has been improved on the individual devices.

CrowdStrike Falcon is stable in my opinion.

I rate the scalability of CrowdStrike Falcon a 9 on a scale from 1 to 10.

I am satisfied with CrowdStrike Falcon's customer support and rate it a 10 on a scale from 1 to 10.

CrowdStrike Falcon has not enabled me to consolidate or replace other security tools.

CrowdStrike Falcon is deployed in my company via an MDM. The Mobile Device Management system through which CrowdStrike Falcon is integrated is Baramundi.

My experiences with pricing, setup costs, and licensing for CrowdStrike Falcon indicate that it could always be cheaper.

I rate CrowdStrike Falcon a 10 due to the satisfaction I feel from the fact that everything works and everyday work is made easier.

My advice for others who are considering CrowdStrike Falcon is to bring in each module one by one and first test it through a POC.

CrowdStrike Falcon serves as my organization's main endpoint protection solution, encompassing both the EDR and NG-SIEM components. In a recent situation, I detected and responded to an incident where a user's laptop was stolen. I initiated containment and used the Advanced Event Search feature within the NG-SIEM module to investigate the user's telemetry and determine whether a compromise had occurred.

CrowdStrike Falcon has positively impacted my organization by enabling us to make a significant leap to a mature tool, providing greater overall security across all endpoints and making my team's day-to-day work easier.

Since implementing CrowdStrike Falcon, I have primarily noticed an improvement in exception management. CrowdStrike does not require exceptions, whereas with other EDRs I constantly have to manage them.

Using CrowdStrike Falcon has changed how my security team detects, investigates, and responds to threats. It has made us more agile and allowed better adaptation of the tool to how my team works, compared to other vendors where I have to adapt more to their systems.

The benefits I have noticed from having several security capabilities integrated into a single platform include agility and simplified administration of the tools.

CrowdStrike Falcon has improved my security team's workload and productivity by reducing detections, since I have been able to adapt the tool to my team's needs.

CrowdStrike Falcon has allowed me to consolidate and replace other security tools by unifying EDR and SIEM in a single platform.

The best features that CrowdStrike Falcon offers include the EDR component, which I consider to be a very complete tool due to features such as IOC management, IOA management, device management, and policy management, along with other modules like NG-SIEM, which I also consider quite complete.

The feature I consider especially valuable for my day-to-day work that has made a clear difference in my operations is policy management. It is very well executed, allowing me to go into a lot of detail, and it is well thought out from a management perspective.

What sets CrowdStrike Falcon apart from other cybersecurity platforms I have used or evaluated is mainly the maturity of the product.

I believe CrowdStrike Falcon could improve by listening to customers, as we are the ones who can best provide feedback on the tool, what we are missing in it, and how to improve it.

Regarding workflow management, CrowdStrike Falcon could allow better management of permissions.

I have made several attempts to use artificial intelligence within CrowdStrike Falcon, specifically Charlotte, but since it has not given me good results, I have not continued using it. I made two attempts since acquiring it, and after a recent conference, I am going to give it a third try.

Regarding the artificial intelligence capabilities of CrowdStrike Falcon, my opinion about its governance and security is that if by artificial intelligence you mean Charlotte, at the moment I do not consider it to be working.

In terms of the accuracy and reliability of the results offered by artificial intelligence in CrowdStrike Falcon, I believe there is significant room for improvement.

I have been using CrowdStrike Falcon for approximately one year.

Occasionally, I have noticed an impact of the CrowdStrike Falcon sensor on endpoint performance or on the ability to deploy security at scale, but this occurs in few cases.

I consider CrowdStrike Falcon to be stable at the highest level.

Since my initial deployment, I have expanded the use of CrowdStrike Falcon in my organization. I started with a single CID and a single console, and I now have three.

I rate the scalability of CrowdStrike Falcon as perfect, since it is completely transparent to me and I only need to request it.

I find CrowdStrike Falcon's customer support to be quite good, with areas to improve, but above average compared to other vendors.

I would rate customer support as an eight on a scale from one to ten.

I was previously using another solution, which I cannot mention, and I decided to switch to CrowdStrike Falcon due to limitations of the other tool.

I have seen a return on investment with CrowdStrike Falcon in terms of time savings for my team at the highest level.

Before choosing CrowdStrike Falcon, I did evaluate other options, but I cannot name them.

On a scale from one to ten, I would rate CrowdStrike Falcon a nine.

I give it a nine and not a ten because there is always room for improvement, and there will always be details to polish.

CrowdStrike Falcon is deployed in my organization as Public SaaS.

The cloud provider I use to deploy the solution is CrowdStrike's own console.

My advice for other professionals who are considering using CrowdStrike Falcon is to go for it, as long as they can afford it.

I primarily rely on CrowdStrike Falcon for endpoint security EDR and host-based firewall.

In my day-to-day work, I have policies for endpoint security where, for example, using Teams and Netskope, I have different rules from the endpoints, and I also use it for device control.

Since the initial deployment of CrowdStrike Falcon, I have added more features. I was using a limited host-based firewall, and now I am using more of it, and I am also expanding it on macOS.

Using CrowdStrike Falcon has positively impacted my organization, and I have seen changes in my security posture and operations since using it. I would rate it an eight.

Using CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats, and it is really effective.

Having multiple security capabilities all on a single platform like CrowdStrike Falcon is valuable because I do not have to use and integrate with multiple products, which is really good.

Having endpoint identity, cloud, and other security telemetry in the same CrowdStrike Falcon platform is beneficial. CrowdStrike Falcon has affected the workload and productivity of my security team positively, and I find it very accurate.

I really like Guardian One, which is very nice and futuristic for an AI.

The feature that stands out to me about Guardian One is that I have a lot of new AI agents, and I have a new team monitoring and securing them, which is very important. I do not have it as of now, and I am still exploring, and this will definitely add value to my company and security.

Regarding CrowdStrike Falcon's AI capabilities, I think its governance and security are pretty good, but I am yet to explore it further.

I find the accuracy and reliability of output from CrowdStrike Falcon's AI capabilities interesting since I attended the session for Guardian, but I just did a lab, and I am not really sure how it would work in a practical environment, so I am yet to explore.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is that it is very accurate and I think there are not many false positives, making it more effective than any other product.

I find the console not very user-friendly. Sometimes, creating a policy is not very straightforward since I need to create a user group, a rule group, and a policy, making it kind of complicated compared to Palo Alto XDR or EDR or any other product. Even though it is very secure, it could be more user-friendly.

I have been using CrowdStrike Falcon for one year.

I have not noticed much change regarding the impact of CrowdStrike Falcon sensor on endpoint performance and my ability to deploy security at scale. CrowdStrike Falcon is stable.

I think its scalability is pretty good.

The customer support is not really great. It is pretty complicated, especially when I ask very difficult questions or dig deep into the features, as I do not see good support most of the time, so I think it is important to improve this.

I was previously using McAfee, but now I am using CrowdStrike Falcon, and it is performing better than McAfee.

In my previous company, I was using Cortex XDR, Sophos, and McAfee, but now I am using CrowdStrike Falcon, and I made the switch as a Security Specialist.

Before choosing CrowdStrike Falcon, I evaluated other options, particularly McAfee.

I rate it an eight mainly because it is not that user-friendly; otherwise, I would give it a nine.

I would rate CrowdStrike Falcon a nine out of ten overall, as it is mainly the user-friendliness that affects my rating. As a cybersecurity product, it is really great and very futuristic, but just because it is not that user-friendly sometimes, I would rate it a nine.

I would advise others reading reviews on PeerSpot that for the upcoming AI world, CrowdStrike Falcon is doing really great and has very good features with a lot of new AI-powered capabilities, so I think switching to CrowdStrike Falcon is a really good idea.