CrowdStrike Falcon Reviews

The main use case I have for CrowdStrike Falcon is incident response.

In an incident response situation, I use CrowdStrike Falcon by leveraging telemetry and RTR to connect and acquire artifacts.

I believe the detection team is using artificial intelligence within CrowdStrike Falcon, though I am not on the detection team.

CrowdStrike Falcon has positively impacted my organization by allowing the integration of a large number of endpoints, enabling the creation of much higher telemetry, greater speed, and better integration.

CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats through the telemetry aspect and the ability to run scripts on the fly, which have given us better overall capabilities.

The benefits I have observed from having multiple security capabilities integrated into a single platform include speed in understanding what is happening, integration, and not dealing with different formats at every moment.

CrowdStrike Falcon has affected the workload and productivity of my security team by providing greater efficiency, allowing us to work faster and manage resources better.

I consider the best feature offered by CrowdStrike Falcon to be the ability to run PowerShell scripts on the fly for incident response, which includes PowerShell or Bash.

The ability to run scripts in real time has benefited my incident response team by allowing us to acquire artifacts and reach the root cause more quickly.

I think CrowdStrike Falcon could improve by focusing on sections or teams at the SOC level.

I would appreciate greater capabilities for incident response teams and not just for SOC teams, which are slightly less technical than incident response teams.

I rate CrowdStrike Falcon an eight because its telemetry is quite powerful on Windows, but on Linux and macOS, the telemetry and capabilities are still considerably lower.

I have noticed that the CrowdStrike Falcon sensor sometimes uses a large amount of resources on my personal machine, though this may also be because the machine itself is not very good.

I have been using CrowdStrike Falcon for eight years.

What sets CrowdStrike Falcon apart from other cybersecurity platforms I have used or evaluated previously is that the ones I used were considerably older and therefore their capabilities were lower.

I rate CrowdStrike Falcon an eight on a scale of one to ten.

As far as I know, CrowdStrike Falcon is deployed in the public cloud, but I cannot be completely certain due to my lack of details.

I have not expanded my use of CrowdStrike Falcon since the initial deployment; we are still using it the same way.

I would not give any particular advice to those considering implementing CrowdStrike Falcon because there are too many variables that depend on the company name, number of employees, and budget.

My main use case for CrowdStrike Falcon is endpoint protection.

I basically use CrowdStrike Falcon to counter ransomware and all types of modern attacks, as I believe it has the capability to defend against the latest threats and also from APTs.

I think CrowdStrike Falcon is pretty lightweight, but very powerful considering its lightweight size, so it is very good for my environment and basically it is a very good product.

My use of CrowdStrike Falcon platform has not really expanded yet, but I like what I am using.

CrowdStrike Falcon has positively impacted my organization by boosting my overall defense on endpoint security, as I previously relied on traditional antivirus, which I do not think could keep up with modern threats anymore.

Since switching to CrowdStrike Falcon, I have noticed outcomes such as being able to really look at my risk posture and be more proactive rather than reactive.

Using CrowdStrike Falcon platform has changed the way my security team detects, investigates, and responds to threats as it basically provides more information into the event, so we do not have to go to other systems to fetch that data. In the past, I had to look in many different places to get the context of the event, but now I only have to look in CrowdStrike Falcon.

Having multiple security capabilities on a single platform in CrowdStrike Falcon definitely saves time and makes it more efficient, more effective, and gives us a head start when an incident breaks out.

The value of having endpoint identity, cloud, and other security telemetry in CrowdStrike Falcon platform is that it is very good being a one-stop shop where I can find most of the information I need when I am doing incident response and also my daily security operations.

CrowdStrike Falcon has made my job easier to some extent, but it is basically a better tool that I am using.

In my experience, the best features CrowdStrike Falcon offers are visibility and protection, and also comprehensive information on the assets.

The visibility feature of CrowdStrike Falcon helps me day-to-day by giving me very good visibility into the assets that it manages, so when I am looking at incidents or investigating events, I get a better understanding of the context. For example, I can see who is using the computer, who was logged in at the time, and what processes were run on the endpoint.

CrowdStrike Falcon sensor has really little impact on endpoint performance, and that is what I appreciate about it.

The console of CrowdStrike Falcon is a little bit too overwhelming for beginners, so if it could be a little bit more intuitive, that would be a great improvement.

I have been using CrowdStrike Falcon for more than two years.

CrowdStrike Falcon is very stable.

CrowdStrike Falcon has pretty easy scalability, so it has good scalability.

Customer support for CrowdStrike Falcon is great, and I find it wonderful.

On a scale of one to ten, I would rate the customer support an eight.

My experience with pricing, setup cost, and licensing was that it was very easy and very smooth.

CrowdStrike Falcon did not allow me to consolidate or replace other security tools.

My main use case for CrowdStrike Falcon is endpoint protection, as well as Identity Threat Protection, which brings us more value. We also want to use it intensively in cloud security, and exposure management helps us in many cases.

I use Identity Threat Protection in my work by checking information in it even if I don't get any detection on CrowdStrike Falcon, since I don't have access to Active Directory, and I find it valuable.

CrowdStrike Falcon has positively impacted my organization since it was already deployed when I was employed. I find it valuable as it brings all the functionalities together with one agent, one platform, and one dashboard.

In terms of positive changes in my team's workflow since using CrowdStrike Falcon, collaboration is another subject for me, but the security side is reliable and I am able to rely on my tool, accessing useful telemetry data and modules.

CrowdStrike Falcon has changed the way my security team detects, investigates, and responds to threats by making the investigation more systematic.

For example, one night at 11:00 PM, we had a detection because of a malicious IP, and after triage, I called one of our incident response team members, which led us to contain the server relatively fast.

The best features CrowdStrike Falcon offers include real-time threat detection, which is very helpful for detecting phishing emails. I also find the lightweight agent effective for usage, making deployment relatively easy.

Regarding the features, we still do not have the AI features in place in our environment due to strict data protection regulations in Germany, but I hope that we can use the new suggested features more intensively soon.

Having multiple security capabilities on a single platform with CrowdStrike Falcon brings the benefit of a lightweight agent, which is really helpful to work in our environment.

One way CrowdStrike Falcon can be improved is that I find it challenging when I make a search and get timestamps that are not in real time. I prefer them to be in a human-readable format.

I have noticed significant improvements in user interface and queries since I started using it.

I have been using CrowdStrike Falcon for more than four years, nearly five years.

On a scale of one to ten, I would rate CrowdStrike Falcon between eight and nine.

I consider moving it up to a nine because the tool is really perfect and reliable.

Regarding CrowdStrike Falcon's AI capabilities, I think its governance and security are good. Telemetry is shared and collected anonymously, and I trust CrowdStrike as they know what they are doing.

The accuracy and reliability of output from CrowdStrike Falcon are acceptable, but I notice that sometimes the information is poor initially and improves after a few minutes of processing.

CrowdStrike Falcon is deployed in my organization on endpoints and servers on AWS.

We use AWS mostly as our cloud provider.

My advice for others looking into using CrowdStrike Falcon is to have Identity Threat Protection and exposure management with Spotlight, as they are important.

My main use case for CrowdStrike Falcon is for security. We recently had some user credentials get lost in the shuffle, and I use CrowdStrike Falcon to figure out what had happened and correct the issue so it would not happen in the future.

The best feature that we appreciate about CrowdStrike Falcon is the ability to run APIs and manage things like UDP connections with non-licensed Microsoft accounts.

The API functionality and managing UDP connections with non-licensed Microsoft accounts makes my work easier by giving us another MFA method for elevated accounts that are non-licensed.

CrowdStrike Falcon has positively impacted my organization by allowing fewer people to do more workloads, so it has saved us time, money, and effort.

From what I have used so far, CrowdStrike Falcon is very accurate, and the output gives a good overview. I think it does a good job.

CrowdStrike Falcon is deployed in our organization in a hybrid cloud setup, and we install the sensor via Intune on each Autopiloted machine.

I feel the weakest thing about CrowdStrike Falcon is their documentation.

I have been using CrowdStrike Falcon for a year and a half.

CrowdStrike Falcon sensor has increased our security at scale, as before we had to do different updates, different policy fixes, and management one at a time.

CrowdStrike Falcon has allowed us to replace Microsoft Defender, and the impact was a cost savings.

Switching from Microsoft Defender to CrowdStrike Falcon improved detection and response time because it is all in one place. It gives you a cleaner reference for the incident.

What differentiates CrowdStrike Falcon from other cybersecurity platforms I have used or evaluated is ease of access, cost, manageability, and customization.

Using CrowdStrike Falcon platform has changed the way my security team detects, investigates, and responds to threats by giving us a broader range of the threat, more idea of what the issue is, and helping us with our solution. It has decreased our time and allowed us fewer employees to function at a faster pace.

My advice to others looking into using CrowdStrike Falcon is to not get overwhelmed and to start small with a lot of data. We have not used the AI within CrowdStrike Falcon at this point. I would rate this product a 9.

We are protecting our endpoints, workstations, servers, and cloud workloads. This includes effective use of antivirus and detection and response capabilities.

I am working at Arab Open University, and we are using CrowdStrike Falcon as our security product.

The most beneficial part is the active response capability of the product. Being an EDR solution, it helps us identify attacks in real-time. The product runs in the background 24/7. The most interesting aspect is the behavior analysis functionality, which analyzes the behavior of any suspicious activity.

It identifies threats efficiently due to its built-in intelligence and AI capabilities, which has been extremely helpful for our organization.

Some features such as device control, firewall management, and file analysis are standalone products that we need to purchase separately. If these features came out of the box within the product, it would be much more beneficial for us. Other providers such as SentinelOne include these features in their base product.

We attended a CrowdStrike Falcon event where they discussed some shallow AI features, but we cannot see these in our panel yet. We work with different solutions such as Darktrace and SocRadar, where AI features are automatically displayed in our dashboards after release. However, for CrowdStrike Falcon, we cannot see these features.

Sometimes there are minor glitches, approximately 1% of the time. The biggest issue occurred when every computer worldwide experienced a blue screen. However, they solved the problems and introduced a new feature for channel updates. This has been much more beneficial, and while human errors can occur in any product, we cannot solely blame CrowdStrike Falcon for such incidents.

The customer service is good and efficient in terms of responding. They could improve by initiating calls for high-priority cases instead of just opening tickets. When we open a support ticket, they should call to discuss what happened and listen to our concerns.

Neutral

The setup is straightforward, and most of our integration is within the package. However, for the integration part, we need to purchase additional modules from CrowdStrike Falcon. If this functionality was included as a free standalone feature within the built-in solution, it would be more market competitive. Competitors such as SentinelOne and Microsoft Defender provide this functionality out of the box without additional charges.

We have not calculated the ROI extensively, as we typically only calculate it when there is dissatisfaction. On a scale of one to ten, the ROI would be five, which translates to approximately 60%.

I am currently using CrowdStrike Falcon as an EDR, which is integrated with SIEM. We also work in a real-time environment with the product. As a Falconist, I perform investigation actions on it. There are three different kinds of alerts I deal with: one based purely on IOCs, another process-oriented IOA, and those based on machine learning alerts. This is what I work on, and it is actually a good tool. It has multiple features, including real-time connection to the RTR environment, allowing direct remote host connection through CrowdStrike. I have multiple options like host search and event search, enabling me to do everything I need. It's a comprehensive package. It's a challenging tool to explore, but once accustomed to it, it is quite excellent.

Obviously, when checking in the SIEM, not all logs are available. In CrowdStrike, unlike SIEM, actions are clearly defined. For example, a regular AV like Symantec might indicate a file was quarantined or failed to quarantine, but in CrowdStrike, I can verify the action. As an incident response analyst, I can use CrowdStrike to perform actions like directly wiping a file from a host if given access. I can investigate by accessing the customer's host based on the RTR environment and utilize host search to know details for the past seven days, including logins, processes, file installations, malicious processes, and network connections. Event search also allows for detailed investigations, showing accessed files and remote installations.

In CrowdStrike, with the variety of security tools available, learning the different query languages can be challenging. I use KQL queries with Sentinel and AQL with QRadar, and CrowdStrike's query language is different as well. This requires constant learning for security analysts. Simplifying the querying process, such as using double quote queries or directly obtaining logs based on IP addresses or usernames, would be beneficial. The event search tab in CrowdStrike is complex, though the host search is more straightforward and gets details from the past week. The querying system, similar to Splunk, could be made more user-friendly.

I have been using it for the past two years.

The stability is always great. I have never seen instability in the CrowdStrike tool.

When it comes to scalability, it is entirely based on premium models according to demand. Our log retention is low, but paying more increases it. Scalability is moderate, based on the charges paid to the CrowdStrike product service team. Offering good services, like better log retention at a lower price, would be excellent.

The CrowdStrike team is very efficient; I would rate them ten out of ten. They respond quickly when it comes to providing services.

Positive

I have worked on Symantec ATP, advanced threat protection, but it is a legacy product. Many companies have moved away from Symantec, and they use legacy antivirus solutions. The integration with Symantec ATP was tough, and event or host searches were based entirely on raw logs.

The current setup is easy, but it could be more natural and make drill-down searches simpler. With advancements in AI, integration could streamline responses further, but there is still room for making the process easier.

The integration task should be done by engineers. I'm interested in the process and have learned something about integration, but we have not fully explored all integration aspects.

CrowdStrike is a great solution. It's a hands-on tool. I have not seen other EDRs like it. Compared to Carbon Black, which is much more difficult with a different UI, CrowdStrike allows direct, detailed investigation with a PID generated for each process. It offers unique abilities not seen in other EDRs. Overall product rating: nine out of ten.

My main use case for CrowdStrike Falcon includes patch management, endpoint security, and next-gen SIEM. A concrete example of how I use CrowdStrike Falcon in my day-to-day work involves exposure management, patch management, and vulnerability management. In implementing exposure management with CrowdStrike Falcon, my main focus is on vulnerability management.

CrowdStrike Falcon has had a positive impact on my company by allowing us to raise our IT security infrastructure to the next level and improve our protection by 100%. I can share measurable results, such as faster response times and no security incidents.

In my view, the best features that CrowdStrike Falcon offers are identity protection, next-gen SIEM, and data loss prevention.

The features of CrowdStrike Falcon that I particularly value are the identity protection, as it allows me to identify misconfigured accounts. CrowdStrike Falcon's identity protection has specifically improved my day-to-day work and the security in my company by ensuring that all users now use sufficiently long passwords, I can identify stale accounts, and I can detect compromised password accounts and compromised passwords.

I find the accuracy and reliability of the AI-based results from CrowdStrike Falcon to be very reliable.

In my opinion, CrowdStrike Falcon could be further improved with better clarity of the dashboard. I would also like to mention that the next-gen SIEM could be made clearer.

I have been using CrowdStrike Falcon for four years.

I would rate CrowdStrike Falcon as a 10 on a scale of 1 to 10. The reason I chose 10 is that I don't know of a better product that can cover my requirements this well.

The main use case for CrowdStrike Falcon in my organization is that we focus on securing our customers' endpoint environments, installing the CrowdStrike Falcon agent on their computers and making sure that the protection at the workstation and server level for our customers is ensured with CrowdStrike technology.

Once the licenses are purchased, our engineering and security architecture team installs and implements all the Falcon licenses both on the computers and on the servers of our customers. From there we take care of configuring what we call phase zero, phase one, phase two and phase three of protection for those endpoints, starting with the detection phase where for a few weeks the Falcon agent is learning and detecting our users' behavior. Once we move to phase three, we move to the protection layer where mitigation and automatic response begin for the detections that occur on the endpoints and servers.

CrowdStrike Falcon has positively impacted our organization by ensuring a very high protection layer for all our customers with a very high level of satisfaction due to the great way detections are made and displayed and, above all, being able to see the responses that have been carried out to these detected events.

Detection has improved significantly for all our customers and the number of monitored incidents we have seen is much lower.

The best features that CrowdStrike Falcon offers for our team are above all the ability to detect 100% of all the attacks that the devices are suffering, in addition to covering 100% of MITRE tactics and techniques. The results we are getting are huge. We also know other technologies that compete with CrowdStrike and there has been none that is the same or similar to CrowdStrike.

We consider that Falcon OverWatch for the endpoint and for the Next-Gen SIEM greatly expands the detection capability of the OverWatch team 24x7, and the detection capacity is increased thanks to all the Threat Hunting telemetry we get from OverWatch.

In terms of improving, I think CrowdStrike Falcon could continue developing new technologies for securing AI environments on customers' corporate devices.

I have been using CrowdStrike Falcon for the last two years.

On a scale of one to ten, I would rate CrowdStrike Falcon a 10.

I give it that rating of 10 because the product works very well and it is the best cybersecurity product that exists today versus the competition.

CrowdStrike Falcon is deployed in our organization through public cloud, private cloud and on-premises. In the case of public or private cloud, we usually use AWS as our cloud provider.

My advice to other companies that are considering using CrowdStrike Falcon is that the Falcon sales channel is very good, it offers very good margins and, since it is the best solution on the market, the message for our customers is powerful and easy to sell.

We are using it for endpoint protection, as well as for cloud security coverage. It includes monitoring all our critical servers and endpoint devices. We also design workflows for anomaly behavior detection using machine learning techniques for anything malicious or abnormal. We monitor everything suspicious. We either design the workflows or use CrowdStrike to monitor any new detections and anomaly behaviors, as well as do vulnerability management.

The best benefit of CrowdStrike Falcon is 99% MITRE coverage. It detects suspicious or undetected activities on the system and provides protection for zero-day vulnerabilities. If there is a sudden rise in CPU consumption or abnormal storage use, it helps us by creating a ticket, allowing us to investigate any abnormal behavior present. We can look into the machine and investigate. It reduces the false negatives common with other technologies.

The real-time response helps with MTTR. We achieve faster detection and response times.

It helped prevent breaches. In the past, there was abnormal consumption of RAM along with CPU on a server. It also started communicating with other subnets. CrowdStrike Falcon triggered an alert. We did our investigation and found that we had ransomware. We successfully mitigated it.

The machine learning behavior for anomaly detection is a valuable feature. It helps identify any suspicious or unusual activities within the system.

Furthermore, it has impressive MITRE coverage. 

Deployment in cloud environments is challenging. Another concern is CrowdStrike's GUI. It changes annually, making it hard to work and find options. After a year, options change or integrate with something else, which is challenging for me as it requires relearning. It is time-consuming.

I started working on CrowdStrike in 2018. 

We are following N-1 versions across our environment, which is stable. Due to our requirements, we never switch to the N version; we always stick to N-1 and never face anything abnormal while using it.

It has proven to be a good technology for me. It has adequate coverage and is easy to deploy. Its scalability is good.

It is deployed across the globe.

I would rate them a seven out of ten. They take a lot of time to come back to us.

Neutral

I have used SentinelOne as well. SentinelOne was similar but had major challenges with workflow implementation. Workflow implementation is far easier in CrowdStrike compared to SentinelOne.

We have it in the on-premises environment and cloud environments. For endpoint hosts, it is very easy, but in the cloud environment, there are challenges, especially if we have AWS technologies with Lambda functions, which are serverless.

My implementation strategy was simple. I segregated servers based on criticality, then network, and finally OS level. Anything critical was based on my CMDB asset configuration. Following criticality was the network, determining internal versus public-facing. The last segmentation was on OS configuration. These three categorizations were primarily used in deploying agents across our environment.

In terms of maintenance, there are patches or version upgrades. 

We had a group of five people, which was enough to manage this.

It is worth the money.

It is expensive compared to SentinelOne, but as the market leader, it is worth it.

I would rate CrowdStrike Falcon an eight out of ten. They have some challenges with the cloud environment, which is a major drawback, especially with the serverless aspect. Their GUI also causes issues with regular changes.

If anyone has worked with CrowdStrike, they would promote it. However, cloud security presents challenges. Moving from physical to cloud environments is difficult. I have raised 7-8 tickets to resolve cloud issues, especially with AWS.

We are using CrowdStrike Falcon because it has very low surface impact and minimal consumption of our resources, and we mainly use it for our endpoint protection.

CrowdStrike Falcon helps with endpoint protection by having very low memory utilization and processor usage, so it doesn't impact the computer system performance, and the computer system works very fast compared to all other endpoint protection solutions.

We find it very unique that CrowdStrike Falcon, which we deployed in many countries wherever our offices are, can be installed very quickly, maintained on a single console, single panel of console, and it's really easy to use and deploy. We primarily use it for endpoint protection.

The single panel console of CrowdStrike Falcon is very user-friendly, which is what we are looking for. Having multiple administrators between various offices with this single console gives us the ability to see all offices, branch offices, and partners, making it very useful to detect machines, identify machines, and check security risks. Everything in the single console is very useful.

CrowdStrike Falcon has positively impacted our organization in terms of efficiency because it's very lightweight, easy to deploy, easy to manage, and works very efficiently. It quickly detects issues and doesn't have a signature-based system, so it works fast and takes immediate action.

I don't think anything is missing in CrowdStrike Falcon, but if they can manage their SOC solution instead of users or the end users or customers doing that, it will be very useful, just as Sophos does.

We have been using CrowdStrike Falcon for the past seven years.

CrowdStrike Falcon is stable; I have not had any issues with reliability or downtime.

For scalability, CrowdStrike Falcon deserves a perfect score of ten out of ten.

Regarding customer support, our experience has been really positive as they are very quick to assist us.

The customer support deserves a rating of ten out of ten.

Positive

We were previously using Symantec Endpoint because we were not getting proper quotations, pricing, or support, particularly in India, which is why we wanted to switch.

In terms of return on investment, we find that CrowdStrike Falcon has ROI covered because less manpower is required. It's very easy to deploy without many IT admins, saving time, and while I cannot specify the money saved, the time saved is money in terms of manpower. This makes it very useful, quick to run, quick to install, easy to manage, and easy to deploy.

We do not find any price challenges or setup costs with CrowdStrike Falcon; everything is smooth.

We evaluated three products, which were Sophos, CrowdStrike Falcon, and Trend Micro, before choosing CrowdStrike Falcon.

In some cases, we have Excel files with VBA code inside, and CrowdStrike Falcon detects that it's a bit risky for us. When people download EXE files that are threats to our organization, it detects them very quickly. It also detects threats under ZIP files and can show us the path from where it came and where it goes, allowing us to easily see where the infection is and where it has spread.

My advice for others looking into using CrowdStrike Falcon is that as an endpoint protection solution, Falcon is always reliable, and I can recommend that this is the product you can deploy and forget all the worries.

We are an end user customer of CrowdStrike Falcon; we are not a partner or reseller, and we are not receiving any gift card or incentive for this review. We are just sharing our experience as an end user and as an IT Manager.

I rate CrowdStrike Falcon 9 out of 10.