Item: CrowdStrike Falcon
Rating: 10
Author: David Reyes

Use Cases and Deployment Scope

We're using Falcon Endpoint Protection across the organization, on user workstations (both on premises and remote) as well as Windows and Linux servers. It helps us prevent threats as well as provide intel to investigate threats.

Pros and Cons

It's strong with its EDR capabilities. It's able to collect very useful information for an investigation.
Very lightweight agent doesn't interfere with user activities.
Customizable to get the amount of alerts that can be investigated without getting overwhelming.

CrowdStrike University doesn't have a lot of content, it can be completed in a few hours.

Return on Investment

Improved peace of mind that endpoints are secure.
Access to EDR without breaking the bank.
Faster threat investigations.

Alternatives Considered

Webroot Business Endpoint Protection, Sophos Intercept X and BlackBerry Protect (CylancePROTECT)

Overall I found CrowdStrike Falcon's EDR capabilities superior to their competitors. Also, the user interface has taken its time to mature and is very intuitive and has a natural flow. Policy configuration and assignment as well as the features and settings within the config were more complete and met all our requirements. Lastly, the agent plays nice with everything else running on systems. We hardly ever have issues of Falcon interfering with users or services, and false positives are kept at a minimum.

Products Replaced

Not Sure

Trial Experience

We did use a trial, and worked with account rep to extend the trial to finish testing scenarios we wanted to cover, and our request was accommodated to ensure we could do proper testing.

Introduction to CrowdStrike

Not sure where I heard from CrowdStrike first, but it's been a leader in the EDR space for some time now.

Likelihood to Recommend

Falcon Endpoint Protection has proven to be a very complete and robust solution. It's great for mixed environments where devices are scattered across different sites, to include remote users. It supports all the operating systems being used across the organization which is another plus. With our previous endpoint protection solution, investigation typically required access to the affected endpoint. With CrowdStrike Falcon Endpoint Protection, all the intelligence is collected and accessible from the console. The amount of information is very vast and makes for very complete threat investigations. Lastly, the user interface is very refined, and polished, which makes navigating the console very straightforward.

A Complete EDR Solution

Software Version

Modules Used

Overall Satisfaction with CrowdStrike Falcon Endpoint Protection