What is our primary use case?
My main use case for CrowdStrike Falcon Complete MDR is securing our endpoints against malware and handling the malware without our involvement.
The most prolific attacks that we see are click-fix attacks, which involve the running of command line commands from a website that download a malicious script and exfiltrate credentials. These attacks are very commonly picked up and prevented from executing by CrowdStrike Falcon Complete MDR, who then verify that there are no artifacts remaining on the endpoint.
The security challenges and resource constraints that led my organization to choose CrowdStrike Falcon Complete MDR are absolutely a resource constraint due to lack of staff and budgetary concerns over staffing.
An example where CrowdStrike Falcon Complete MDR identified or contained a threat that would otherwise have required significant effort from my team is with click-fix types of alerts. They are incredibly effective at finding secrets and exfiltrating them very quickly.
CrowdStrike Falcon Complete MDR works alongside my internal security team and existing SOC processes as it is the first step of triage and response. The service handles all of the false positives and all of the other detections that happen on the device and then escalates to us when they identify something serious that we need to see.
How has it helped my organization?
CrowdStrike Falcon Complete MDR has positively impacted my organization by reducing the amount of workload that the security operations team is required to do when it comes to malware detections and the response to them almost entirely.
Based on the volume of detections that we see and the volume that CrowdStrike Falcon Complete MDR handles, we are almost certainly saving about a whole analyst cost-wise and time-wise per year.
CrowdStrike Falcon Complete MDR has changed the workload of my internal security team by removing the requirement for my team to be heavily involved with endpoint detections and the response to them.
For endpoint-related detections, the service affects my organization's mean time to detect, investigate, and respond to threats rapidly. Detections occur within seconds as well as an interruption in the malware execution that really leads to a massive reduction in how much time we need to be spending on these. Detections are usually very quick, with a detection within a couple minutes, an escalation to my team within 15 to 20 minutes, and response actions and artifacts collected within an hour.
CrowdStrike Falcon Complete MDR has positively affected my confidence in my organization's ability to respond to security incidents, as I feel absolutely more secure. Endpoints are where credentials live and can be retrieved, so securing the endpoint is one of the most important places to control.
What is most valuable?
The best features CrowdStrike Falcon Complete MDR offers include being able to view the process tree and how these things execute.
I find the process tree and seeing how things execute to be really valuable because instead of digging through the logs or creating queries that give us the layout of what exactly happened, there is simply a tab that I can look at and see the full flow of the malware detonation. It can tell me pretty quickly where, when, and why this happened and makes it really quite simple to respond to if additional actions are required.
My experience with CrowdStrike Falcon Complete MDR's capabilities for threat detection, investigation, and response is very positive. The process tree is incredibly valuable, and there are lots of links within detections to help jumpstart understanding of what happened and why the detection triggered. The response to threats with scripts and remote access to the device makes it really quite easy when we need to respond, though that is something that we typically do not need to do with CrowdStrike Falcon Complete MDR.
My experience with CrowdStrike Falcon Complete MDR's 24/7 monitoring and response capabilities has been overall quite great, as I feel that almost all of the detections escalated to us are things we actually need to be involved with, either to know about or to take action on.
I have detailed visibility into the investigations and actions performed by the CrowdStrike Falcon Complete MDR team, as the escalations contain more than enough information for us to understand why it is coming to us, why it was important in the first place, and what we need to do.
The combination of CrowdStrike technology and human security expertise in the MDR service is quite valuable, as it is clear that the engineers who escalate to us are very knowledgeable about how malware acts and the traces that it leaves.
What needs improvement?
Detections are usually very solid, but we have seen a couple instances where a detection was not fully remediated, and then we had additional malicious behavior afterwards that we had to investigate and discuss with the CrowdStrike Falcon Complete MDR team. A tightening of the remediation of the detections is key.
For how long have I used the solution?
I have been using CrowdStrike Falcon Complete MDR for two years.
What do I think about the stability of the solution?
CrowdStrike Falcon Complete MDR is stable.
What do I think about the scalability of the solution?
CrowdStrike Falcon Complete MDR's scalability is very good, as it is very scalable and easily deployed to a variety of different endpoints and operating systems.
How are customer service and support?
We have had mixed results with customer support, but typically we find that when we reach out, the team that is responding to us is quite responsive. If there is a feature lacking or something that does not quite work the way we expect it to, unfortunately, it seems that there is a bit more of a wait when it comes to our interactions and what we need.
What was our ROI?
I have seen a return on investment, as the volume of work that is required from the sheer number of detections that CrowdStrike Falcon Complete MDR finds and handles without our involvement is massive. It is taking at least an analyst on our end, but almost certainly more with the 24/7 off of our plates.
What other advice do I have?
On a scale of one to ten, I would rate CrowdStrike Falcon Complete MDR a nine.
I choose a nine because the price is competitive and lots of what the product does is great. I do not give tens unless I am truly blown away by a product.
Regarding CrowdStrike Falcon Complete MDR's AI capabilities, my organization does not use this feature, but I am confident in how CrowdStrike Falcon Complete MDR handles data governance.
CrowdStrike Falcon Complete MDR is deployed in my organization on-premises.
My advice to others looking into using CrowdStrike Falcon Complete MDR is to have a good understanding of your workflows, playbooks, and other processes, what you need to do, and what you need to have your analysts expect to respond to. Have your escalation process figured out so that when things are sent to your internal SOC teams, you are able to handle these detections and escalations appropriately.
Which deployment model are you using for this solution?
On-premises
Disclosure: My company does not have a business relationship with this vendor other than being a customer.