Item: CrowdStrike Falcon
Rating: 9
Author: Verified User

Overall Satisfaction with CrowdStrike Falcon

Use Cases and Deployment Scope

We use the CrowdStrike Falcon XDR platform with some of the addons, like IdP and spotlight, and find it works well as a complete solution for endpoint protection, as well as a SIEM. The IdP module integrates well with AD and Entra ID, and the workflows also integrate well enough with everything else via webhooks.

Pros and Cons

Pros

Endpoint Protection
Identity Protection
SIEM

Cons

Vulnerability and Patch Management
Integration with a lot of cloud services, like Meraki, require a local syslog server as a forwarder
All help articles and the knowledge base require a login every time

Return on Investment

Has saved a lot of time managing endpoints, and does not require a local server to call back to
Remote powershell response is very helpful in day to day administration
Testing groups are easy to set up and manage

Innovative Uses

Remote Windows management with powershell
Trace user activity to machines more easily
Automate isolation of some servers when under attack

Alternatives Considered

Symantec Advanced Threat Protection and Microsoft Defender XDR

CrowdStrike Falcon is way ahead of Symantec, and covers features that defender XDR doesn't, even if you purchase all the addons. I think the only real competitors are Sentinel One, maybe Palo Alto or Huntress, or Carbon Black.

Key Insights

Do you think CrowdStrike Falcon delivers good value for the price?

Yes

Are you happy with CrowdStrike Falcon's feature set?

Yes

Did CrowdStrike Falcon live up to sales and marketing promises?

Yes

Did implementation of CrowdStrike Falcon go as expected?

Yes

Would you buy CrowdStrike Falcon again?

Yes

Other Software Used

Cisco Meraki Dashboard, Microsoft 365 Business Premium

Likelihood to Recommend

Good for medium to large businesses, but small businesses would find it a bit too complex to set up and manage. You need to take the time to fine tune the settings and to manage and respond to detections, as well as build up a number of automated responses based on your particular risk strategy.