CrowdStrike Falcon Complete MDR Reviews

It basically works as an XDR. We have the kind of servers on which our XDR CrowdStrike is installed, and it generates alerts. 

For example, if someone tries to install a systematic agent from their end, it generates an alert. We can then investigate through the incident task and see all the information: the device name, the hostname, and which servers and devices are trying to uninstall the particular product.

It basically works as a security device and provides an extra layer of security to our devices and computers.

Earlier, we used SentinelOne. CrowdStrike has more features than SentinelOne. For example, SentinelOne doesn't have as many features like remediating and showing more information. In CrowdStrike, we can see more information about the incident.

It has a great dashboard and interface, which is very user-friendly. It also provides a detailed analysis of each incident.

It should be integrated with AI and ML. For example, if we face zero-day vulnerabilities on our VCs, integrating them with AI and ML would be great. It's like SOAR, which we use, which automatically remediates everything, eliminating human work. If CrowdStrike also implements this kind of AI and ML feature, it would be beneficial.

I switched my organization to it about three months ago, in April. So, since April I have been using CrowdStike.

I haven't seen any bugs. If I encounter null errors or errors while doing integration or other tasks, I report them. Until now, I haven't seen any bugs.

Since I haven't seen any issues so far, I would give it a ten out of ten.

We have deployed it on every device, so we use it in a large number.

I would rate the scalability a nine out of ten. 

In my previous organization, I used SentinelOne, which is also an XDR. When I switched to a new organization, they were using CrowdStrike.

That's how the switch happened. 

It's cloud-based. I think the cloud is good because deploying on-prem is difficult compared to the cloud. In the cloud, we have better security options, we can log in from anywhere, and we don't have to manage the servers ourselves.

Deployment time: It depends on the number of servers we are using. If we have many servers, it will take some time to install on each device. If the environment is small, it would be a quick installation.

If we need help, we can contact the CrowdStrike Falcon team.

It's quite good. Our organization is very big and has a good budget, but the licensing part is handled by upper-level management.

CrowdStrike has a reasonable price. It's a good price, but if CrowdStrike offered coupons or discounts on a monthly or quarterly basis, it would be more beneficial for smaller vendors trying to implement security. Cutting down some prices would be better so that everyone can use it.

I would recommend CrowdStrike. Even if I were using it and someone asked me which tool to use, I would recommend CrowdStrike.

Overall, I would rate the solution a ten out of ten. 

When work-from-home scenarios started in March 2020, during the pandemic, in the month of April, we were actually going through some POCs and had one ransomware attack on one of the client sites. We had to deploy the solution immediately, which actually helped us find out or not how it worked. Proactively, we could identify some threats in the environment and act on them. We were virtually identifying items and getting notifications, as well as seeing the availability of the intra. That was very helpful for the entire team.

The solution is very nice. It's got multiple products for multiple features and enabled multiple settings, which helped my team and the organization is also in a way better way. Since it was lockdown the last two years, when the entire organization went to working from a remote location, the earlier solutions, what we had, were of no use. We were most concerned about security over the cloud. Carbon Black has helped us handle that.

Before we used to support multiple clients. We had to have some connectivity to the client's environment via Citrix or something. To access any of our solutions was a challenge when most of them were on-prem. Those were challenges for all of us. Now, most of the world has gone to the cloud. That actually helped us. Obviously, CrowdStrike was a different experience altogether.

I personally work on advanced threat hunting and identifying possible malicious activity or the possible threat in our environment which is getting easier earlier. Symantec Engine Protection, for example, gives you known reactive reports where you get stuff from either SIM or some soft team to help us on finding out probably the path for the attack. However, CrowdStrike is better at hunting threats and catching them early.

There's less workload on the Endpoint. After moving to CrowdStrike we never have this issue of systems getting overutilized by any of the security tools. That was one of the biggest advantages for it.

CrowdStrike has multiple parameters of components in the same console, which includes your vulnerability scanning. It has access to, or rather, we can integrate with, our existing SIM technology or SIM tool. The information that gets passed on the SIM control, the soft tool data site or any other tool is very limited. I had to actually provide the control access to my soft team so that they could drill down if needed.

The information was get passed on from Falcon control to CrowdStrike and it was very limited. It was acting as more of an alert only. For any further deep-dive analysis, we had to log in on the console itself. 

CrowdStrike has multiple parameters. For example, my vulnerability scanning team is a separate team who works on different tools altogether. If I need to give them access to my console I just need to provide them read-only access or kind of an admin access for VA scanning.

I had to make some customized access that can be provided to different teams on the same console. As a VA team member, if I login to the console with my credential I should be able to see the things which I am working upon. I don't need to see all other tile stack tabs. I should be able to provide some kind of customized access or other kind of access control for the console.

Microsoft Defender has one good option which is called the ASR rule. It basically allows the machines to be onboarded to different consoles, which analyzes the process of it and summarizes it in a single console. Obviously, the number of incidents of the event are very huge. It takes about a month or so to evaluate. However, after the evaluation completes, you can actually fine-tune what should not be present in your automation. Which you can set up and get rid of it. It would be nice if this product had something similar. 

I've used the solution for two years.

The stability is very good. It does not have any kind of payload on the endpoint, and we don't need to compromise with system performance. The legacy tools used to have this agent needed to be deployed and consumed a lot of system resources. In terms of performance, this tool was an improvement on the legacy.  The capabilities of CrowdStrike as a tool are fantastic.

We are working with about 18,000 endpoints and about 2,000 servers.

The scalability was really good. It covers most of the recent operating systems I would say in India, although most of our customers are using Microsoft operating systems only. In terms of my international clients who have different operating systems, including Mac, Linux, or Unix, this works. CrowdStrike has the maximum availability for all possible and the latest operating systems. With other tools. we didn't have that level of flexibility.

Technical support was fantastic, however, frankly speaking, we barely had a chance to get in touch with the technical support as CrowdStrike has a fantastic health portal within that console. There were a couple of scenarios where we went to them as some kind of alert that CrowdStrike was publishing it to the customer only. They had some specific name for those alerts. Those used to get sent to the customer's end only. Being automation as security, CrowdStrike has a policy to provide the information only to the registered customers only. Obviously, the licenses are issued to the customer. However, the licensing policy was limited in that we were kind of a vendor, or rather, a mediator between the customer and the OEM and we fell through the cracks. 

I would say in my earlier solution, we used to just provide the license number. If the license number were verified, we would get all types of support. 

Overall, the support team was really good. They are more capable of understanding the other challenges and would then provide the solution.

Mostly, we were providing all the technical support to the customer. The licenses were installed with the customer's name. We were slightly lacking as the details that OEM was providing were direct to the customer and we were being skipped. At the same time, we used to struggle to get the details and updates or more input from the OEM from CrowdStrike. 

Positive

We moved from Symantec Endpoint to CrowdStrike.

The initial setup was slightly complex although it's an easier solution. It took us about a month to understand the entire process of the console.

Within a month we were able to train our members to a certain level and within a six-month span, all members actually became familiar for the technology.

We had some challenges from the client environment as well. That was expected as we were ruling out Symantec as well at the time. Concurrently, we were moving out of Symantec and deploying through the CrowdStrike agent. We were also doing the policy fine-tuning, which took a slightly longer time as the customer had their own developed applications and tools for finding their hashes. We added features like device control, app control. Those parts took slightly longer, however, it was still quicker than the legacy solution.

We have two people available to handle maintenance. 

The deployment was handled by my technical team only. Internally, we had eight team members deploying it. They were using a big fix as a deployment tool to deploy this agent on all the clients. I was leading the admin part of CrowdStrike. We had to involve the patch management team who could push a particular script on all the endpoints to onboard them. Most of the endpoints were working remotely and luckily we fixed everything there in the cloud which was making our life easier for onboarding scripts on the client.

I'd rate the solution nine out of ten. 

CrowdStrike Falcon Complete is our EDR solution. It has many modules including vulnerability management, discovery, account application, and assets

Compared to our previous security products, CrowdStrike offers greater efficiency with its various modules that provide full functionality. We've found it to be a helpful tool overall. However, there are some challenges depending on the specific use case and industry, such as finance or retail. This is likely because we're accustomed to our legacy products and CrowdStrike is still new, requiring a learning and testing phase for our team.

We implemented CrowdStrike Falcon Complete to replace the legacy solutions in our environment.

We are impressed with CrowdStrike Falcon Complete SLAs.

The most effective features for detecting and mitigating cyber threats are machine learning and behavior analytics which are well-versed.

CrowdStrike Falcon Complete significantly enhanced our overall security by minimizing false positives, eliminating the need for system restarts during or after deployment.

CrowdStrike Falcon Complete helps us detect and mitigate threats quickly through positive alerts and fast response times.

The management console is user-friendly.

All of the modules are good. The exposure management covers vulnerability management in discovery.  

We find CrowdStrike Falcon Complete to have a steeper learning curve when it is deployed in certain industries such as finance and retail.

I have been using CrowdStrike Falcon Complete for three years.

The technical support is good.

Positive

We were previously using legacy solutions and replaced them with CrowdStrike Falcon Complete because of the next-gen EDR capabilities it offered.

CrowdStrike Falcon offers superior support and technology, making it a better choice than our outdated legacy solutions.

I would rate CrowdStrike Falcon Complete eight out of ten.

CrowdStrike Falcon Complete provides clear and detailed documentation.

We use Falcon to protect the overall environment, including the client and the servers.

We've seen a tremendous improvement since implementing CrowdStrike Falcon. In the past few years, we were exposed to 30 different attacks, but now our environment is completely monitored, and everything is detected. It catches threats and attacks before they occur. We get more visibility across the environments than we've ever had before. When malicious activities are happening, we see the notifications immediately. It's a huge improvement over the response time of our previous solution.

We like the SOC teams that support the service. CrowdStrike has a huge SOC team that responds immediately when they discover any incident or risk in the environment. They conduct the forensic behind the tool, coordinating with our in-house team. 

We get an immediate response to threats and reporting about whatever actions are taken across the entire organization and the environment. Each system is reporting to CrowdStrike what happened behind the scenes. They have an impressive tool for monitoring and discovering what happens in every part of our systems.

I think the overall user experience for the operations team could be improved. The dashboard could be more effective, like Microsoft Defender. Microsoft worked on refining the user experience. The security monitoring tools could be simpler and more user-friendly. Integration with the application layer might be another area for improvement. 

We have used CrowdStrike Falcon for nearly a year.

A good indicator of the product's stability is the stability of the environment itself. The product is highly stable. 

We haven't expanded it, so I don't know what would happen if we tried. 

I rate CrowdStrike support 10 out of 10. They have a perfect support team. When we're working with technical support, it's like you are talking into a community, not just one person talking to you about incidents. You have a community supporting you.

Positive

We previously used Trend Micro Apex One. There were too many threats in our environment that went undetected, so we saw little value from Trend Micro. 

The portal is on the cloud, but there are on-prem agents. The deployment required about four or five people. It was straightforward and took about a week to cover all environments. Around three or four people are needed for maintenance. 

Although it's an expensive solution, we see a return because security is the top priority.

I don't know the details of the licensing, but Falcon Complete one of the most expensive solutions we have right now.

We looked at a few products, including Microsoft Defender. It's a good player in the game, and we believe Defender will be the next stage.

I rate CrowdStrike Falcon Complete 10 out of 10. I would recommend Falcon Complete to others. To those planning to implement Falcon Complete, I recommend cleaning the environment before installing the new product. You need to ensure every tool that was installed on the machines is removed.

Our company uses the solution for our exchange servers, key directory servers, and radio servers.

We currently have three users but may expend in the future depending on strategy and budget.

The endpoint detection and response is very valuable.

The solution should be lighter because it currently uses a lot of computing sources.

I have been using the solution for six months.

The solution is definitely stable so stability is rated a nine out of ten.

The solution is definitely scalable so scalability is rated a ten out of ten.

We contacted technical support once and there was a delay from that SOC center. We haven't contacted support again.

We previously used McAfee but were facing a RAV somewhere in a couple of servers.

The pricing is a little bit expensive for our region.

It is not expensive to get implementation assistance from partners.

Our company is a dealer for Trend Micro so we are more focused on their products.

I can't compare the solution's features to Trend Micro because I can't get them to work in the same environment.

I recommend using the solution. Nowadays, there is a cyber warfare so a bit of protection is important. I rate the solution an eight out of ten.

We use this solution for endpoint and server protection.

The reporting for this solution could be improved. This would make it more proactive in showing what happens during enrolment.

This is a stable solution and we have not experienced any issues. 

This is a scalable solution and we have more than 100 PCs.

The technical support is good. All it depends on the rules you have in place for the engagement of support.

The initial setup is easy and straightforward. It is easy because we set it up for about 500 endpoints in two day or three days. 

We have experienced ROI using this solution. The value is clear when you are able to stop a ransomware attack or other threats. All the money that you put into this protection is the money you save by preventing a problem.

 We pay 40,000 euros to use this solution. 

The engagement rule of this solution is fundamental to its use.The rule you put in place can determine how effective this solution is for your business. 

I would rate this solution a nine out of ten. 

I use the solution for a lot of things. It has more visibility than core tech. For example, it's better the TSC scores and that any integration visibility with Zscalar.

The solution helps to provide a better security posture. 

The solution provides more visibility than Zscaler.

There's more security. It provides enhanced security with integration capabilities with third-party tools. 

The threat detection and response are easy. If you have a subscription for the Falcon Consultant Complete sublicense, then they will take care of your MDL service. They will assign their team to it, and they will manage your incident detection and monitoring. CrowdStrike will take care of it via its own expertise so you don't have to overload your existing resources. 

It helps improve our security posture by integrating with web security, email security, and other forms of security. There are also a lot of third-party tools. You have the opportunity for more alerts and security. CrowdStrike shares information with third-party tools that really help with visibility.

The solution is constantly being updated. 

I've been satisfied with the interface. 

We'd like to see the option for an uninstall feature directly on the cloud. It's a tokenless install; however, you should have a token while installing and uninstalling. 

The installation could always be a bit easier. You need to install it manually at the endpoint. 

I've used the solution for a year. 

The stability is very good. I have not witnessed any downtime. 

This is a cloud-based solution, You can easily scale it. 

Technical support has been very good. They are very helpful. It's a strong point for the product.

Positive

I have also used different solutions. For example, I have used Cortex.

The initial setup is very straightforward. It was a simple process.

I'm a technical engineer and don't have visibility on the pricing. However, it can be a bit lower than other options. 

I'd rate the solution 8 out of 10. I can completely rely on CrowdStrike. 

Our customers use it, but we deliver the services. We use it for advanced endpoint protection capabilities and threat-hunting capabilities. We use it for data lakes and repositories to reduce the cost and computational efforts for submitting or uploading in the cloud.

By implementing CrowdStrike Falcon Complete, we wanted to improve the visibility of our operators, analysts, and engineers. We wanted to be more efficient in our operations. Instead of finding information themselves, they can use the platform to find the information automatically.

Its benefits can be seen from the beginning. It is super easy in terms of deployment, and it works perfectly with the human resources and the stack of technologies that our clients have.

Partner support is beneficial. They are a trusted partner. They plan to continue in the market by themselves. They are not expecting somebody to purchase them. It helps to build confidence with the clients, and we can trust that nothing will change in that aspect.

They continue to improve their threat-hunting capabilities, which is important for me because there are more and more advanced threats, such as zero-day attacks. If we combine these threat-hunting capabilities with endpoint detection, we have an extra layer of response. It is super strong for us. We have different agents: one for detection and monitoring and the other one for the preventing aspect, which means threat hunting and response. I can combine the telemetry for threat hunting and monitoring and respond properly.

They are working hard to continue and enhance their labs for identifying new threats and malware. They are continuously labeling them with fancy names for marketing, but they are super helpful and useful because malware and attacks are labeled as per what is happening in specific industries or at specific locations. They give you an overall idea about what is going on not only in your country but also all over the world, and more specifically, in the industry you are working with.

The team of Falcon Complete works around the clock and does monitoring around the clock. It is quite good because it is a solution that combines monitoring and response, and at the same time, it labels all the threats in the world. They are super helpful in managing the threat exposure that companies face on a daily basis. 

The continuous improvement in detections and response times is valuable. They are more focused on threats that come from the cloud, not only that we see. Five or six years ago, we were just focusing on the infrastructure. They, for sure, have better coverage for the supply chain devices or assets that are in the environment of the clients. We have better coverage of third-party vendors, and we have more visibility and more interactions with those third-party vendor solutions.

Some features can be enhanced or improved. For example, there can be more integration capabilities.

There can be an application for the mobile device for the administrator of the platform to have an overview. In less than two minutes, they should be able to see what is going on and take action. Having an overview in a mobile phone would be super helpful for the administrators because everybody has a mobile phone nowadays.

I have been working with CrowdStrike Falcon Complete for four years.

It is stable. It is 90% compliant with what they promised.

It is scalable.

Their support is quite good. I would rate them a seven out of ten. They can add better resources or more resources locally.

Neutral

I am not involved in its deployment, but it can be deployed on-premises and on the cloud. The cloud provider depends on the client's preference. We do not have any issues.

It is expensive, but looking at the capabilities that it brings, it is reasonable.

There are no additional costs to the licensing costs. If you increase the number of licenses, support is included.

I would rate CrowdStrike Falcon Complete an eight out of ten.