CrowdStrike Falcon Next-Gen SIEM Reviews

I work on Identity Governance for this solution. We onboard the logs into the SIEM, into CrowdStrike Falcon, and we ensure that we get alerts on time and create dashboards using that data. Our work is basically log onboarding.

Everything is flowing compared to how long it was before. Probably in two minutes, you can get the data.

CrowdStrike Falcon Next-Gen SIEM is a very vast tool, and while we discussed it, it can be used for many purposes, but we are using it only for the log onboarding at this point. That solved my purpose and it really helps me in finding the root cause of an error or a problem. Logging into servers and finding out and tracing information on multiple servers is difficult. With a search field or query where you can filter, you can get the data instantly. That is great.

While we are onboarding our logs, we can see the timeline where the error was happening, and then we were able to troubleshoot following the timeline in the thread. The search was easy, and we were able to investigate and find the errors correctly.

It reduces the time to log in to servers to see what is going on since everything is in one place. We have multiple servers, so that saves a lot of time in not logging in.

CrowdStrike Falcon Next-Gen SIEM has a capability to scale very long, which I feel will continue with the new features that are coming out.

False positives and workload definitely have an impact on alert volume and analysis workload. It reduces stress and improves efficiency and tracking mechanisms. Trying to resolve things makes it efficient.

Alert volume is impacted. It is very interesting. Very recently, I have been using a browser in one of the servers and that triggered an alert immediately because we did not know what the browser was doing in the back-end. I could see that it is using its plug-in or its cookies or communicating with different various sites. I got an alert and was shocked to see what was going on in the back. I just loaded it, installed Chrome, and did not know what was going on. But when I got an alert, I saw that it was talking to Facebook, Google, and so many other things. Then I went there and looked at that alert, and then I uninstalled that browser immediately. That was incredible. I appreciate that feature.

The only thing which I worked on is log onboarding, so I stick to that. It gives a lot of information with respect to the metrics or KPIs based upon the SIEM because you onboard your logs and see various features from an application-wise, showing what has been implemented. Showing that in the application is difficult, but showing it in the SIEM is pretty easy based upon what we do. That stands out for the usage.

I do not use automations within CrowdStrike Falcon Next-Gen SIEM at this point, but that is something that we want to do in the future.

Maybe I did not experiment or did not investigate, but if we can get alerts based upon the CPU utilizations and the metrics over there, probably that would make this one tool used for everything.

Actually, the circumstances that prompted my company to explore new SIEM solutions maybe include a point where the storage space or the license that we have, probably compared to other SIEM products, they have more, or the pricing and sales that go into the picture there. Again, that is above my pay grade to comment on, but it probably could be better if we can provide more storage of the data for the license that has been provided for organizations.

I work as an IAM engineer and have ten years in my current field.

So far, the stability and reliability of CrowdStrike Falcon Next-Gen SIEM is good. From my use, it has been pretty solid. I appreciate that there are different ways of integration that you can provide. It is not a situation where it has to be in a format or a different format. It can take everything and then normalize it and show it in a way that a user can understand.

CrowdStrike Falcon Next-Gen SIEM has a capability to scale very long, which I feel will continue with the new features that are coming out.

Support from CrowdStrike is not relevant for me.

There was Splunk before, and then it got migrated to CrowdStrike Falcon Next-Gen SIEM.

I have not been involved in the deployment of CrowdStrike Falcon Next-Gen SIEM.

The integration of CrowdStrike Falcon telemetry with other security data sources within the SIEM is something that the team can explain, but my usage is very limited.

I have definitely seen a return on my investment with this solution.

Pricing, setup costs, and licensing of CrowdStrike Falcon Next-Gen SIEM is not my area.

There is Grafana, there is Dynatrace. There are many more SIEM tools that you can talk about. The only difference is the fact of looking at the thread and making graph relations and showing it visually. That stands out with CrowdStrike Falcon Next-Gen SIEM. But with respect to other tools, what is lacking, I do not know. Maybe I did not experiment or did not investigate, but if we can get alerts based upon the CPU utilizations and the metrics over there, probably that would make this one tool used for everything.

I have been attending some sessions to see how we can use CrowdStrike Falcon Next-Gen SIEM more. I appreciate the Charlotte AI, the agentic thing. Probably we will try to see what is going on there. The team is already doing the infrastructure management using CrowdStrike Falcon Next-Gen SIEM. That is not my expertise there, but there is something that I can still let the team know about this new development.

I just got to learn about Charlotte AI yesterday in the session, and that is very interesting where you can track the core workstation to actual incident and the adversaries. That is interesting. That is probably something that I want to explore.

CrowdStrike Falcon Next-Gen SIEM is a vast tool. It has everything from basic to advanced. The documentation is very vast, so that is one thing that you need to go through and try to understand, because the terminology used is niche.

In the majority, this is true. I am actually trying to clear a certification from CrowdStrike, so I am preparing for that. Learning through the documentation is much more useful. It is pretty nice. My overall rating for this solution is ten out of ten.

My main use cases for CrowdStrike Falcon Next-Gen SIEM are log ingestion, security and access log ingestion, and detection engineering.

In an investigation or incident where CrowdStrike Falcon Next-Gen SIEM played a significant role, we had cases where in our stadium, when people come in, they bring in compromised devices, and the devices try to reach out of our internal networks to the outside, which the firewall is preventing. Because the traces are coming from various parts of the logs, some from Wi-Fi logs, some from firewall logs, and some from device logs, we needed one solution to combine the insights from all those logs to track down where it happened and who potentially the culprit could be.

The environment I'm managing within CrowdStrike Falcon Next-Gen SIEM is primarily on the Falcon cloud, so we don't have to deal with that. However, our environment includes on-premises, cloud, and a variety of other systems. Our on-premises infrastructure consists of a couple of sites: one is a stadium and the other one is a training ground, and we have a couple of stores. We have around a thousand employees, which means workstations and other devices. Because of migrations from different software and different tools we use, there is constant change and upgrades in the stadium. There are different devices and different sources of data we use. With all of that variety and churn, it has been easy to simply point that at CrowdStrike.

I can quantify improvements in detection, investigation, or response times since deploying CrowdStrike Falcon Next-Gen SIEM. The biggest improvement when we switched from a legacy SIEM solution to CrowdStrike Falcon Next-Gen SIEM was the improvement in speed and how much faster the queries and searches were happening. That allowed for improved time to detection and response in general. CrowdStrike Falcon Next-Gen SIEM, at the moment, allows us to get everything from different data sources into the same place and allows us to automate in a more confident way. It has considerably improved over the years I've been using it and has become better with Fusion Workflows. There are more integrations happening that allow us to deploy responses across different platforms. For example, if there's an indication of a phishing campaign happening, the moment we see it happening, we have a workflow that automates responses and gives us more insight into what's happening and notifies people that need to know as an automated workflow. That has been very useful.

If I estimate in percentage or hours how much faster it is compared to my legacy SIEM, I'd say we got a 75 percent improved speed just from remembering the queries we compared across. When we moved from the legacy SIEM to CrowdStrike Falcon Next-Gen SIEM, we translated the queries from the previous query language we used into the CrowdStrike query language. We just compared the run speeds to the previous one, and that was a 75 percent improvement then. At the moment, we're not really comparing because we know we're working with a very fast solution. It's not something we pay attention to now, but for the period when we migrated a couple of years ago, that was a very stark improvement. It allowed us to reduce the times. In the previous legacy SIEM, we had to give it five minutes for the log ingestion. Once the logs are ingested, then the way automations go, we give it five minutes to think about it. For CrowdStrike Falcon Next-Gen SIEM, we reduced that to two minutes when we converted the workflows. It has become even faster now too.

CrowdStrike Falcon Next-Gen SIEM has definitely changed the speed at which my team searches, investigates, and responds to security events because of how fast the parsing happens and how fast the searches happen. It allows us to do things faster. I can't really put a number on it because we have not tried to estimate it after we first moved. We saw the improvement was considerable. After that, we just think about what time we need to give it to think. It's the new normal, so it's hard to say. It definitely has not been getting worse. I can feel that.

The automations within CrowdStrike Falcon Next-Gen SIEM have changed the work my SOC analysts perform day-to-day by allowing us to reduce the number of tickets the SOC is dealing with. After we have identified the consistent sources of false positives or benign true positives, they're easy to identify. The automation can handle them, triage them, classify them, and close them without involving the human in the loop. That means the SOC now only pays attention to the real threats and the real false positive tickets where human attention is required. We still use automation to enrich those and provide more context, but it has definitely allowed us to reduce the volume of tickets the SOC looks at. We are now confident that many of the false positives and the items that just don't need human attention anymore don't get it, and our SOC analysts can look at the real cases now.

We have reduced our ticket volume due to automations in the 90th percentile.

We have been able to consolidate SOAR or other SOC tools within CrowdStrike Falcon Next-Gen SIEM. Once we moved our workflows and logic from legacy SIEM into CrowdStrike, we've been doing optimization, improvement, and cutting items where necessary. That's more a part of the process of optimizing and upgrading things and seeing the new features that have been coming out in Falcon and in general in CrowdStrike Falcon Next-Gen SIEM. This has also allowed us to improve that. Especially now that the Falcon AIs are available, we can use them with custom detections and expanded capabilities. It's not only targeting the Falcon detection but also allows for part of the detections. That has also improved, so there's a lot more synergy now going on.

The impact of CrowdStrike Falcon Next-Gen SIEM on my alert volume, false positives, or analyst workflow is not a simple answer because it's more related to what kind of logs we ingest, how we process them, and whether we enrich them. Often enough, it depends on the log source. For example, some firewalls we onboarded trigger a lot more detections. But once we see that certain event codes should not be a detection, we just disable them as a detection. It's a work in progress, but CrowdStrike Falcon Next-Gen SIEM is very easy to configure in that way. We can say that for this log source, we don't make detections, and we're going to use custom integrated workflows. If this query finds something, it's going to make a detection based on the logs we have. We have the ability to customize what's going to become a detection, how it's going to be detected, and the ability to combine different detections into a case. That flexibility has allowed us to use it in more depth to correlate different types of logs and combine all of that into one case instead of it being dispersed into 10 different detections.

The integration of CrowdStrike Falcon telemetry with other security data sources within the SIEM makes things easier. There are a lot of predefined data sources we can ingest, but there's also an ability to customize it ourselves. We can use the parsers that are provided, but also if it's a more complicated or less useful data source, we can make a custom parser. That allows us to customize how the data is coming in and how it connects with others. It also allows us to do some filtering and transformation. Once we started using the CrowdStrike data format, we just started to make sure everything comes in the same format. That way, the queries are more transferable. Just following the same CrowdStrike parsing standard and applying it to our different data sources, even less usual ones, has allowed us to standardize everything and make it seamlessly connect with each other.

We are using Charlotte AI and other capabilities within CrowdStrike Falcon Next-Gen SIEM, and we added AI triage to the detections. Not only does the person look at them, but an AI also gives a quick review of what it thinks it is and an additional opinion. When a person looks at the case, there's already more context and more enrichment with an AI's opinion. We use both Charlotte AI and some of our internal models for that. That has been very useful for the CrowdStrike feature where we can bring our own models and our own capabilities into that.

CrowdStrike Falcon Next-Gen SIEM can be improved with the Fusion Workflow. Some integrations, specifically APIs, could be improved because there are so many different formats, so it's not consistent. Sometimes the Falcon UI does not agree with what's in practice. It could be made a bit more flexible. The Fusion Workflow, especially with the API calls and integrations with third parties, is the area for improvement. When they work, they work seamlessly and perfectly. But when it doesn't, it creates an extra layer of complexity that shouldn't be there. That's the biggest way to improve it at the moment.

I have been using CrowdStrike Falcon Next-Gen SIEM for most of my time, considerably more in the last year. I have been using it daily now.

I would assess the stability and reliability of CrowdStrike Falcon Next-Gen SIEM as excellent because so far, we have had no issues. It has always been stable and reliable. Any issues we could usually trace down to our own internet connection rather than the SIEM itself. For example, I'm looking at the SIEM through a Wi-Fi connection, and the slow connection's fault rather than the SIEM's fault is the cause. We have never had issues with reliability or it being down or unavailable, or unreasonably long search times. We haven't really encountered those yet.

I would evaluate the scalability of CrowdStrike Falcon Next-Gen SIEM by saying the trickiest part is just to make sure only what we need is going to the SIEM. Because there are many different log sources, if we just point all the firewall logs, it's not a good practice. We had to come up with some filtering solutions. But once we know what we want and how we want it, there have never been issues with the SIEM side. It's just making sure we're sending what has to be sent there. While also complying with different requirements, we have to maintain a full log copy for long storage or hot storage for a year for forensics and other needs. There are different considerations, but once we send everything we want and need to the SIEM, it scales easily and does what we want it to do.

I would evaluate CrowdStrike's support as reasonably fast when we have used them. Most of the time, we get answers to our questions or we get pointed to the people who have the answers. We've used both the support and subject matter experts from CrowdStrike to answer our questions. So far, we've had a good experience and nothing really to complain about.

The legacy SIEM I used before was Splunk.

The circumstances or factors that prompted my company to explore new SIEM solutions were the migration from the legacy SIEM. Basically, it was becoming too big, too slow, too hard to manage, and too overcomplicated. CrowdStrike Falcon Next-Gen SIEM allowed us to simplify many things that should not have been an issue in the first place.

I would describe my experience with deploying CrowdStrike Falcon Next-Gen SIEM as very fast and very efficient. Part of it is because CrowdStrike Falcon Next-Gen SIEM is already a managed platform, so we didn't really have to deal with installing it or tuning it. That's handled by CrowdStrike. The management overhead we had to deal with in the legacy SIEM was gone. That was the main advantage.

Our main cloud provider is Google with a bit of AWS.

I would rate CrowdStrike Falcon Next-Gen SIEM an eight and a half or nine. It's not perfect, but it's the best I have used so far.

My main use cases for CrowdStrike Falcon Next-Gen SIEM in my company include deploying rules, sending telemetry data, and performing detection and prevention. We also use third-party software such as AWS CloudTrail binding, so we retrieve data from AWS cloud directly into CrowdStrike Falcon Next-Gen SIEM.

In Germany, we only use AWS as our cloud provider.

We started using Charlotte AI within CrowdStrike Falcon Next-Gen SIEM three months ago, utilizing our 200 credits per month for detections, gathering information about the detections, and helping us investigate them.

We need two SIEMs, using CrowdStrike Falcon Next-Gen SIEM for its features and the other SIEM for 24/7 response.

An investigation where CrowdStrike Falcon Next-Gen SIEM played a significant role was an in-house penetration test ordered by our CISO, where a tester was evaluating exploits and malicious activities inside our network. CrowdStrike Falcon Next-Gen SIEM provided a detection that the tester was attempting to spoof LDAP on our Active Directory to steal credentials. I was alarmed because my CISO had not informed me that it was a penetration test; I thought we were under attack. However, the CISO confirmed it was an authorized test.

Since deploying CrowdStrike Falcon Next-Gen SIEM, we have achieved better reaction time because we use the notification and detection capabilities of the product. We have integrated numerous connectors and third-party tools, allowing us to gather information in one centralized location within CrowdStrike Falcon Next-Gen SIEM, which simplifies notifications and improves reaction time by an estimated 70 to 80%.

CrowdStrike Falcon Next-Gen SIEM has significantly changed the speed at which our team searches, investigates, and responds to security events because it provides a comprehensive overview of network activities. All detections from separate modules are now combined in CrowdStrike Falcon Next-Gen SIEM console, allowing the team to view numerous detections and prioritize them by severity to work faster on critical issues.

The impact on alert volume, false positives, and analyst workload has been significant. Initially, we received massive notifications and false positives, but as we received more detections, we adapted by categorizing them as false positives and prioritizing them accordingly. CrowdStrike learns from our classifications for future detections, enabling us to improve our workflow.

CrowdStrike Falcon Next-Gen SIEM telemetry integration with other security data sources within the SIEM has tremendous impact because we have faster visibility supported by data gathered from third-party software. We can implement workflow and rule automation, creating efficiencies through telemetry data from third-party solutions.

Automations within CrowdStrike Falcon Next-Gen SIEM have changed how my SOC analysts perform their daily work by saving time, particularly when isolating resources for incidents with high or critical impact.

The feature of CrowdStrike Falcon Next-Gen SIEM that I value most is the ability to integrate numerous third-party platforms and interact with other tools while binding them with CrowdStrike Falcon Next-Gen SIEM. This simplifies implementation in our SIEM because third-party software typically has complicated API interfaces requiring extensive programming to retrieve resource or telemetry data. CrowdStrike provides out-of-the-box connectors that we can use to accomplish this integration.

CrowdStrike Falcon Next-Gen SIEM is technically very well built; however, there is room for improvement. Dashboard settings sometimes change due to CrowdStrike updates, and the company should provide an overview of which function in the module is located where, enabling faster access to settings such as setting a rule or viewing detections.

I have been using CrowdStrike Falcon Next-Gen SIEM for three years.

I assess the stability and reliability of CrowdStrike Falcon Next-Gen SIEM as good. Sometimes telemetry data arrives slower than expected, but I cannot determine if the issue stems from the console, the notebook, or network bottlenecks. Overall, the product performs well.

We have replaced or consolidated SOAR and other SOC tools with CrowdStrike Falcon Next-Gen SIEM, specifically implementing SOAR workflows within CrowdStrike.

The impact on our operations has been positive, as we have moved several functions from another platform into CrowdStrike Falcon Next-Gen SIEM, resulting in savings in both money and time.

We explored a new SIEM solution including CrowdStrike from the beginning, and when we purchased it, key stakeholders discussed pricing and licensing, concluding that we should include CrowdStrike Falcon Next-Gen SIEM from the initial deployment.

We evaluated other SIEM solutions before selecting CrowdStrike Falcon Next-Gen SIEM, and we still operate both QRadar and are currently transitioning to Google Chronicle.

I would rate CrowdStrike Falcon Next-Gen SIEM a nine. There are still areas needing adjustment, such as rules and telemetry data examples. Out-of-the-box, if you are not well-versed with JSON or YAML, you can make numerous errors and misconfigurations. CrowdStrike should provide more examples and better implementation guidance for each operating system.

CrowdStrike Falcon Next-Gen SIEM's main use case in my organization is collecting information and general telemetry from security sources to detect suspicious behavior patterns.

To collect telemetry and detect suspicious behavior, I use native CrowdStrike collection mechanisms or rely on third-party technologies such as ETLs in general.

I make use of the full suite as the vendor proposes to carry out effective detection.

CrowdStrike Falcon Next-Gen SIEM played an important role in investigations where the trigger was an alert raised or detected through the EDR, allowing me to perform a centralized search of the rest of the telemetry such as browsing, traffic data, and DNS queries. Having everything unified in a single point allows for that type of action.

I have noticed significant improvements in the speed and effectiveness of my security analyses since I started using this tool. The product has evolved substantially in recent months.

CrowdStrike Falcon Next-Gen SIEM has positively impacted my organization because for all clients who already had CrowdStrike EDR deployed, it has been a natural step. Clients find it very positive to perform this without having to deploy third-party technologies.

I have noticed specific improvements in response times and in the efficiency of my team since the platform was implemented. As I implement more workflows and start using all of the platform's functionalities, efficiency increases and response times relative to detection times decrease.

I can quantify improvements in detection, investigation, and response times since I deployed the platform. Using workflows and all of the automation makes it possible to significantly reduce response times compared to detection times.

The speed with which my team searches for, investigates, and responds to security events has changed significantly since I started using CrowdStrike Falcon Next-Gen SIEM, especially compared with more legacy solutions.

CrowdStrike Falcon Next-Gen SIEM telemetry integrated with other security data within the SIEM has impacted my organization's security operations positively. Having everything centralized allows me to perform a complete search without having to jump between different platforms.

I have been able to consolidate or replace legacy SIEM, SOAR, or SOC tools, which has had a positive impact on my organization through cost reduction, time reduction, and centralization in single environments that allow for greater efficiency.

CrowdStrike Falcon Next-Gen SIEM's best features are the ability to centralize everything in a single point, both the endpoint telemetry part and telemetry from third-party sources.

I use automations within CrowdStrike Falcon Next-Gen SIEM, and they have changed the daily work of SOC analysts by allowing their work to become focused on the creation of Fusion workflows rather than the analysis of alerts.

I use Charlotte AI or other artificial intelligence capabilities within CrowdStrike Falcon Next-Gen SIEM on a day-to-day basis, which allows us to have a much more complete view of what is occurring and helps resolve doubts, problems, or specific use cases.

Regarding the AI capabilities of CrowdStrike Falcon Next-Gen SIEM, I rate its governance and security around an 8 or 9.

I believe the accuracy and reliability of the results offered by CrowdStrike Falcon Next-Gen SIEM's artificial intelligence also rates around an 8 or 9.

I think that ultimately some aspects of CrowdStrike Falcon Next-Gen SIEM, such as online and offline retention, could be improved. The entire topic of integrating the data lake with third-party systems beyond CrowdStrike itself would give more versatility to the whole scope of using CrowdStrike Falcon Next-Gen SIEM.

The necessary improvements revolve around being able to store information in third-party repositories and being able to do federated searches without having to connect to third-party systems.

I have been using CrowdStrike Falcon Next-Gen SIEM for a year and a half to two years.

I consider CrowdStrike Falcon Next-Gen SIEM to be stable.

I rate the scalability of CrowdStrike Falcon Next-Gen SIEM as very scalable.

The customer support I have received from CrowdStrike Falcon Next-Gen SIEM has been good.

Based on my experience, I would rate customer support for CrowdStrike Falcon Next-Gen SIEM an 8 or 9.

The factors that led my organization to explore new SIEM solutions before deciding on CrowdStrike Falcon Next-Gen SIEM were mainly evolution compared to legacy technologies that were falling far behind from other vendors.

Before switching to CrowdStrike Falcon Next-Gen SIEM, I was using other legacy solutions that worked well in the past but are no longer sufficient today.

I have not observed a clear return on investment yet. Perhaps in a few months, with the whole AI implementation, it will have more impact in that regard.

My experience with pricing, implementation costs, and licensing for CrowdStrike Falcon Next-Gen SIEM encompasses multiple scenarios. There have been cases where it has turned out positive and cases where prices have been higher, depending on the specific circumstances and ecosystem of each client.

I evaluated other options before choosing CrowdStrike Falcon Next-Gen SIEM because I am somewhat agnostic in terms of technology use and I try to know and work with all of the market leaders.

On a scale from 1 to 10, I would rate CrowdStrike Falcon Next-Gen SIEM a 7.

I give it a 7 because at the technology level it works very well and perfectly delivers what it promises. However, like all technologies, there is always room for improvement and some bugs that I have to work with support to fix.

CrowdStrike Falcon Next-Gen SIEM is deployed in my organization as a SaaS offering that CrowdStrike itself provides, which is a public cloud solution.

I believe AWS is the public cloud provider for CrowdStrike Falcon Next-Gen SIEM.

My advice to others considering using CrowdStrike Falcon Next-Gen SIEM is to establish a specific strategy for combining all telemetry into a single point together with response capabilities.

My main use case for CrowdStrike Falcon Next-Gen SIEM is to provide services to clients; we don’t use it internally. We provide threat monitoring services using CrowdStrike products.

A concrete example of how we use CrowdStrike Falcon Next-Gen SIEM to monitor threats for a client is that we integrate data from different security technologies and products and, together with endpoint telemetry, we generate alerts that we investigate and notify the client about, and we carry out remediation actions.

Besides alert generation and remediation, for this specific product, there is no other aspect of using CrowdStrike Falcon Next-Gen SIEM that I consider relevant in my day-to-day work with clients.

CrowdStrike Falcon Next-Gen SIEM has positively impacted our organization and the service we provide to our clients by being a new paradigm since these types of Next-Gen SIEM tools started to flourish compared to traditional SIEMs.

The specific aspects that have improved mainly include response times and remediation capabilities for clients. By having end-to-end visibility and remediation capabilities, both detection and response times have been significantly reduced since we implemented CrowdStrike Falcon Next-Gen SIEM.

I have not noticed too much impact on the volume of alerts, the number of false positives, or the analysts’ workload since we started using CrowdStrike Falcon Next-Gen SIEM, but in recent months, with the eruption of AI, there is indeed a change in trend regarding the need for human investigation versus AI investigation of alerts.

The integration of CrowdStrike Falcon telemetry with other security data sources within the SIEM platform has had a big impact on our security operations, as CrowdStrike already gives us a lot of visibility, but there are still many independent security products from which we need information to have complete visibility into what is happening in the clients’ environments.

Automations have changed the daily work of our SOC analysts by both reducing manual tasks and improving efficiency. Apart from speeding up response times for some alerts, the main thing is that humans can focus on different aspects, and AI and automation can identify things that would take a human much longer.

We have managed to consolidate or replace legacy SIEM, SOAR, or other SOC tools thanks to CrowdStrike Falcon Next-Gen SIEM for clients whose environments we didn’t have visibility from the EDR standpoint, and we have tried to introduce this tool to improve detection and response capabilities.

The best features that CrowdStrike Falcon Next-Gen SIEM offers, in terms of usability, integration, or detection capabilities, are integration and visibility from the endpoint to the cloud across all of the client’s products and environments.

Regarding that integration and visibility, from a single point it allows me to understand what has happened and what the scope is of the security incidents that our clients may have. In addition to that, we have remediation actions as well, both on the endpoint and in the cloud or any product of the client that we manage.

We do use automations within CrowdStrike Falcon Next-Gen SIEM. We are using Charlotte AI and other AI capabilities within CrowdStrike Falcon Next-Gen SIEM in a limited way, but for example, to build parsers when integrating a data source and significantly improving integration times with other technologies.

Regarding the AI capabilities of CrowdStrike Falcon Next-Gen SIEM, I believe they meet the necessary requirements in general, but we are still in a very early phase. CrowdStrike has been presenting new solutions such as SageMind. For the moment, it’s an unknown; I think on paper these are solutions that look very good, but we’ll have to see how they adapt to each client’s situation and how they adopt and perceive them.

In terms of the accuracy and reliability of the results that CrowdStrike Falcon Next-Gen SIEM AI offers, I would rate it positively based on what we’ve tested it on, specifically parser development—speaking about the engineering team, not the entire company as a whole because there are many teams—it is a good step forward; it’s not perfect, but it’s a good improvement and saves quite a bit of time.

CrowdStrike Falcon Next-Gen SIEM could improve in the whole data ingestion and processing pipeline, as well as the storage capacity, to extend it beyond one year. Being able to adapt to clients’ needs would also be beneficial.

I have been using CrowdStrike Falcon Next-Gen SIEM for one year.

I consider CrowdStrike Falcon Next-Gen SIEM to be stable in the environments where we’ve implemented it.

The scalability of CrowdStrike Falcon Next-Gen SIEM is great as it adapts perfectly well when the number of clients or the volume of data increases, but I think it still has an area for improvement in the log integration part based on the Falcon LogScale Collector, and we’ll see whether it is able to address that or not.

The circumstances that led our organization to look for new SIEM solutions such as CrowdStrike Falcon Next-Gen SIEM included CrowdStrike’s relevance as a vendor in the market and the competitive advantage it already brings by being present in many clients with a product like the EDR.

We previously used a variety of solutions before implementing CrowdStrike Falcon Next-Gen SIEM, including clients who use Splunk, QRadar, and Sentinel. For clients who were thinking of or had already migrated or already had CrowdStrike EDR, I think it makes a lot of sense to introduce this tool to have full visibility.

CrowdStrike Falcon Next-Gen SIEM is deployed in our organization with sensors on each endpoint, but the console is always in the CrowdStrike environment, which is a CrowdStrike private cloud.

Regarding that private cloud, we use a solution managed directly by CrowdStrike.

I have not seen a return on investment by implementing this tool in terms of less staff needed, but I have seen improvement in services based on the aspects we’ve already mentioned: response times, visibility, and, above all, response capability.

My experience with the pricing, implementation cost, and licensing of CrowdStrike Falcon Next-Gen SIEM has been positive as I think it is at a normal standard in the market; there are cheaper vendors, there are more expensive vendors, but in general, I think it is well positioned.

Before choosing CrowdStrike Falcon Next-Gen SIEM, we evaluated other options and considered solutions that best fit our clients among those we consider sufficiently mature and that give us the confidence to provide a good service; other such tools might be Palo Alto XSIAM or the Microsoft security portal, but CrowdStrike is one of them.

On a scale from one to ten, I would rate CrowdStrike Falcon Next-Gen SIEM as an eight.

I give it an eight and not a higher or lower score because I think it’s a fairly complete product, but there are always opportunities for improvement and, as I mentioned, there are some aspects that I still think somewhat limit the capabilities of the product in general.

A very important factor in the decision for other companies considering implementing CrowdStrike Falcon Next-Gen SIEM depends on the EDR, and if they have the EDR, it makes a lot of sense to have this solution.

My primary use case for CrowdStrike Falcon Next-Gen SIEM is monitoring, identification of security events, and incident management.

In a day-to-day situation, logs come in, the logs are reviewed based on the rules, alerts are identified, and the alerts are managed.

I do use automations within CrowdStrike Falcon Next-Gen SIEM.

CrowdStrike Falcon Next-Gen SIEM has had a positive impact on my organization as it has improved the security solution we had before.

The specific aspects that have improved compared to the previous solution include the fact that the EDR part is already integrated from the agent into Next-Gen SIEM, which helps to have more visibility of the telemetry. For the rest, it is up to us to create the rules.

There is no investigation or incident where CrowdStrike Falcon Next-Gen SIEM played a relevant role. What I have found is that there is no difference with other SIEMs as long as you set appropriate rules.

I have noticed a quantifiable improvement in detection, investigation, or response times since using CrowdStrike Falcon Next-Gen SIEM, but not because of the platform. The improvement is because of the change in the alert creation and management model.

The speed with which my team searches, investigates, and responds to security events has improved since we started using CrowdStrike Falcon Next-Gen SIEM, but not because of the tool, rather because of the processes we have defined.

I have not noticed any impact on the volume of alerts, the number of false positives, or the workload of analysts since I started using CrowdStrike Falcon Next-Gen SIEM, because that does not depend on the platform itself, but on the rules you define on it.

The integration of Falcon telemetry with other security data sources within the SIEM has had no impact on my security operations.

Automations have not changed the daily work of my SOC analysts because they are automations we migrated from the past.

I have been able to consolidate or replace SIEM, SOAR, or other SOC tools since using CrowdStrike Falcon Next-Gen SIEM, and that was part of the objective. We have reduced costs and we have a better service.

I consider the best features offered by CrowdStrike Falcon Next-Gen SIEM to be speed in queries.

The speed of the queries has had an impact on my work and my team's work because it is still a solution like any other SIEM, but it is faster and that is a distinguishing factor compared to others.

I think CrowdStrike Falcon Next-Gen SIEM could be improved with better artificial intelligence capabilities.

I give it an eight and not a higher or lower score because although it is quite intuitive, the complexity of SQL compared to other languages like KQL makes it more difficult for certain people unless they use artificial intelligence to create the queries.

We tried using Charlotte AI or other artificial intelligence capabilities within CrowdStrike Falcon Next-Gen SIEM, but it does not work.

Regarding the artificial intelligence capabilities of CrowdStrike Falcon Next-Gen SIEM, I think its governance and security can be improved as there is not much yet.

The accuracy and reliability of the results generated by the artificial intelligence of CrowdStrike Falcon Next-Gen SIEM is not reliable. I would rate it zero.

I have been using this solution for one year.

I consider CrowdStrike Falcon Next-Gen SIEM to be stable in its operation.

My opinion on the scalability of CrowdStrike Falcon Next-Gen SIEM is that it is scalable.

I rate the customer support of CrowdStrike Falcon Next-Gen SIEM positively.

On a scale from 1 to 10, I would rate customer support an eight.

The circumstances that led my organization to look for a new SIEM solution like CrowdStrike Falcon Next-Gen SIEM were that the previous solution was not suitable for what we needed.

Before using CrowdStrike Falcon Next-Gen SIEM, we used another solution, but it was not suitable. It did not have AI functions, nor was it adapted to our needs, nor did it cover EDR as CrowdStrike does.

I have seen a return on investment with CrowdStrike Falcon Next-Gen SIEM, as we have achieved cost reduction by consolidating several tools on CrowdStrike.

Before choosing CrowdStrike Falcon Next-Gen SIEM, we did evaluate other options, including Microsoft Sentinel and Google SecOps.

On a scale from 1 to 10, I would rate CrowdStrike Falcon Next-Gen SIEM an eight.

CrowdStrike Falcon Next-Gen SIEM is deployed in my organization in a private cloud using Amazon Web Services as the provider. However, it is really CrowdStrike's own environment.

I would advise others considering using CrowdStrike Falcon Next-Gen SIEM that if they combine it with a change of EDR, it is a good investment.

My main use cases for CrowdStrike Falcon Next-Gen SIEM include centralized security monitoring, log and event management, threat detection, incident investigation, correlation of endpoint and identity activity, and supporting faster response.

CrowdStrike Falcon Next-Gen SIEM played a significant role in my investigations by helping me move from searching across separate tools to investigating activity in a more unified interface. It gives me better context and makes it easier to connect endpoint and identity, cloud, and other telemetry, which has reduced my investigation time.

I can approximate the reduction in investigation time due to CrowdStrike Falcon Next-Gen SIEM to about 70%.

The main benefits of deploying CrowdStrike Falcon Next-Gen SIEM include less duplicate investigation and more consistent workflows.

CrowdStrike Falcon Next-Gen SIEM improves my productivity in security operations by reducing manual log searching and repetitive correlation work. This allows me to spend more time validating threats and responding to them rather than collecting information from several systems.

Regarding alert volume and false positives, there is approximately a 30% reduction in false positives, though this varies depending on how I categorize them.

The integration of Falcon telemetry with other security data sources within CrowdStrike Falcon Next-Gen SIEM simplifies scaling monitoring as data sources and assets increase. The main consideration involves managing data onboarding, normalization, retention, and cost to prioritize the most valuable telemetry.

I use AI capabilities within CrowdStrike Falcon Next-Gen SIEM mainly to assist with investigation, helping me understand events more quickly, though it is not automated.

I use an automation for containment within CrowdStrike Falcon Next-Gen SIEM, and such use cases bring me value. Using CrowdStrike Falcon Next-Gen SIEM for automation changes my daily work by providing an effective response. It brings me value since I utilize it prior to high severity situations, assisting me when I have malicious or serious threats.

CrowdStrike Falcon Next-Gen SIEM can be improved by reducing dependence on separate monitoring and log analysis tools.

I can enhance CrowdStrike Falcon Next-Gen SIEM's capabilities by using it through SOAR for actions such as resetting or revoking credentials in Entra ID, while still leveraging Active Directory as well.

I have been using CrowdStrike Falcon Next-Gen SIEM for three years.

CrowdStrike Falcon Next-Gen SIEM is stable and reliable for day-to-day monitoring. I have not experienced significant recurring downtime or crashes, which depend on data volume, query complexity, integrations, and how the environment is configured.

CrowdStrike Falcon Next-Gen SIEM scales well with the growing needs of my company and is flexible in that regard.

CrowdStrike support for this solution has been generally useful for technical questions and deployment guidance. The quality is strongest when issues are documented clearly with examples and business impact. However, more proactive guidance for complex migrations would be helpful.

I had a SIEM solution before, specifically IBM QRadar. I am still using IBM QRadar as my primary system. I did not consolidate or replace other SOAR or SOC tools within my operations.

My experience deploying CrowdStrike Falcon Next-Gen SIEM was relatively straightforward when the required data sources and access permissions were clearly defined. The main challenges involved deciding which sources to onboard first, tuning, establishing retention policies, and defining ownership.

Return on investment with CrowdStrike Falcon Next-Gen SIEM comes from reducing investigation time, consolidating tools, and improving my productivity as an analyst. I would measure this through metrics such as mean time to detect, mean time to respond, alert handling time, and time saved.

I did not explicitly look for a SIEM solution. I had a license and acquired CrowdStrike Falcon Next-Gen SIEM together with the CrowdStrike suite.

I would rate CrowdStrike Falcon Next-Gen SIEM a 10. I am satisfied with it, although I know there are areas for improvement. My recommendations include beginning with clear use cases, prioritizing high-value data sources, defining success metrics, and expanding gradually rather than onboarding all sources at once.

CrowdStrike Falcon Next-Gen SIEM's main use case in my organization is expanding the coverage of our detections and automating incident response.

For example, we have automated session reset and password changes when an account is compromised and appears on the dark web.

I can describe an investigation in which CrowdStrike Falcon Next-Gen SIEM played a relevant role, and the outcome was positive. An alert in which a session token was stolen and used from an IP that was not the usual one led to significant findings.

We do use automations within CrowdStrike Falcon Next-Gen SIEM.

CrowdStrike Falcon Next-Gen SIEM has had a positive impact on my organization because we automate containment when there is an incident.

We have noticed an improvement in how little time is needed to remediate incidents since using CrowdStrike Falcon Next-Gen SIEM. We have managed to go from saving days to just hours in time for incident remediation since implementing CrowdStrike Falcon Next-Gen SIEM.

The speed with which my team searches, investigates, and responds to security events has saved us more than 70% of the time by having the sources integrated in one place, and thanks to Falcon MCP, we can use AI to save time.

The workload has been greatly reduced since CrowdStrike Falcon Next-Gen SIEM allows us to automate the closure of alerts thanks to Fusion SOAR.

Previously, analysts had to access the platforms and review the logs, but now they do it directly from CrowdStrike Falcon Next-Gen SIEM, saving time.

We have used Charlotte AI to help improve response time since we can understand the impact of the alerts.

We have been able to replace solutions such as automation with flows like Tork.io since SOAR lets us do the same within CrowdStrike Falcon Next-Gen SIEM.

The best features that CrowdStrike Falcon Next-Gen SIEM offers us are visibility and ease of use.

These features have helped us map risks with MITRE and understand the risks to our company and take actions based on them.

Thanks to different connectors, we can integrate logs with CrowdStrike Falcon telemetry, regardless of whether they are native to the platform or not.

We do use Charlotte AI and other artificial intelligence capabilities within CrowdStrike Falcon Next-Gen SIEM.

Charlotte AI has helped us understand the impact of alerts without having to spend a lot of time reading each of the alerts.

I think the security of the artificial intelligence capabilities of CrowdStrike Falcon Next-Gen SIEM is quite good, as is the governance.

CrowdStrike Falcon Next-Gen SIEM could be improved by making it easier for analysts to map which MITRE indicators they are weakest on.

The overall score is eight and not ten because Falcon Complete does not take care of all the alerts.

My opinion about the artificial intelligence is that Charlotte works well, but it is not entirely intelligent; sometimes it is better to use our own Anthropic or OpenAI models for better results.

I have been using this solution for two years.

CrowdStrike Falcon Next-Gen SIEM is totally stable.

The scalability of CrowdStrike Falcon Next-Gen SIEM is very high.

The support could be improved because the Technical Account Managers do not always have advanced knowledge of the platform.

If I had to rate the support, I would give it a six.

The circumstances that led my organization to look for a new SIEM solution like CrowdStrike Falcon Next-Gen SIEM included the need for improved response times.

We used N8N before, although we still use it for other use cases.

The savings have been huge in both money and time, reflecting a clear return on investment.

This consolidation has helped us free up a huge cost by being able to remove other tools in favor of a single one.

Before choosing CrowdStrike Falcon Next-Gen SIEM, we considered Google SecOps, but we discarded it because it was very complex.

I would rate CrowdStrike Falcon Next-Gen SIEM an eight overall.

I would tell other professionals who are considering CrowdStrike Falcon Next-Gen SIEM to try to integrate all the technologies before they start deploying automations or use cases.

My main use case for CrowdStrike Falcon Next-Gen SIEM is getting all of our log data together in one place that is very easy to search and filter through.

The feature I like the most about CrowdStrike Falcon Next-Gen SIEM is the speed.

CrowdStrike Falcon Next-Gen SIEM has changed the speed at which my team searches, investigates, and responds to security events, with things going from days to minutes or hours.

The integration of Falcon telemetry with other security data sources within CrowdStrike Falcon Next-Gen SIEM makes everything smoother and easier to see under a single pane of glass.

The number one thing that would be an improvement for me is making dashboard creation easier.

For the next release of CrowdStrike Falcon Next-Gen SIEM, I would suggest including data normalization, specifically a way to easily normalize data from different sources, as currently you can do it, but it is a little bit more labor-intensive.

I have been using CrowdStrike Falcon Next-Gen SIEM for three years.

I have not experienced any downtime, crashes, or performance issues with CrowdStrike Falcon Next-Gen SIEM.

I assess the stability and reliability of CrowdStrike Falcon Next-Gen SIEM as 10 out of 10.

CrowdStrike Falcon Next-Gen SIEM scales with the growing needs of my organization, and since we are a small to medium business, it is probably overkill as it stands. We could triple the size of our business and it would still probably be a little bit overkill.

I evaluate customer service and technical support for CrowdStrike Falcon Next-Gen SIEM as great. We have never had an issue, and if we ask, somebody answers quickly, either our account rep or if we submit a ticket, they are very quick about getting back to us.

The circumstances that prompted my organization to explore new SIEM solutions included not having one at all, hearing people expressing dissatisfaction with Splunk and others, and then seeing demos of CrowdStrike Falcon Next-Gen SIEM when it first came out. We thought that it seemed great because it pulls all of our telemetry data and gives us this volume of data to be stored for one year, three years, or whatever we want, automatically, and it is already in our portal with these other products that we use, EDP and Falcon Complete.

Although we did not have a SIEM previously, it would all be consolidated because it is what we have now.

I would describe my experience with deploying CrowdStrike Falcon Next-Gen SIEM as easy. Setting up, even for our firewall integrations, is all piping into a Cribl Transformer that pipes it all directly into CrowdStrike Falcon Next-Gen SIEM, which is very simple.

What worked well were the integrations. The challenges we faced were on the human side, specifically getting used to the query language and how to look for the data, but this is something you just pick up with time.

I have not seen return on investment with CrowdStrike Falcon Next-Gen SIEM because I am not a money person, so I cannot evaluate it in that way.

My experience with pricing, setup costs, and licensing for CrowdStrike Falcon Next-Gen SIEM was fine. It cost money, we paid, and it was good.

We have seen no impact on alert volume, false positives, or analyst workload because we do have Falcon Complete as well, so a lot of those alerts get handled by them.

In an investigation or incident where CrowdStrike Falcon Next-Gen SIEM played a significant role, there was no security incident, but we had plenty of investigative incidents where we were able to pull telemetry from not only the Falcon sensor but also our Microsoft Entra logs, our ExtraHop logs, and our Abnormal Email logs, all integrating together into CrowdStrike Falcon Next-Gen SIEM to get a full, clear picture of what was going on.

I do not use automations with CrowdStrike Falcon Next-Gen SIEM.

We are not using Charlotte AI or other AI capabilities within CrowdStrike Falcon Next-Gen SIEM.

This has given us visibility where we had none.

The expanded usage of CrowdStrike Falcon Next-Gen SIEM is just us using it more, and that process has been very smooth. We are starting to get a few dashboards together and a few saved queries together, and we know what we are looking for a little bit better with our data.

I would advise other organizations considering CrowdStrike Falcon Next-Gen SIEM to try it and run a proof of value and notice that the time it takes to return results is seconds compared to minutes with other SIEMs. When you try that once with your data set, you will be hooked.

I would rate this product 10 out of 10.

My main use cases for CrowdStrike Falcon Next-Gen SIEM involve ingesting our logs from firewalls, F5s, cloud, Zscaler, and then forwarding them via Cribl to CrowdStrike, where I create correlation rules, detections, and playbooks.

In an investigation where CrowdStrike Falcon Next-Gen SIEM played a significant role, I use Falcon Complete to escalate high-priority events, and I receive a lot of detections from Microsoft Defender that I can act on to contact the appropriate product owners and investigate.

A specific example of an incident where CrowdStrike Falcon Next-Gen SIEM helped me was when Microsoft Defender detected a suspicious URL linked to a malicious campaign, enabling me to identify the sender and block the domain.

Using the advanced search feature of CrowdStrike Falcon Next-Gen SIEM provides me with huge benefits time-wise, saving days or hours from my full workload by allowing me to quickly retrieve and manipulate data.

While I cannot provide specific KPIs or numbers regarding the improvements in detection, investigation, or response times since deploying CrowdStrike Falcon Next-Gen SIEM, I believe that Falcon Complete filters out the most important detections and significantly reduces the time to respond by approximately 20 to 30 percent compared to my previous solution.

The impact of CrowdStrike Falcon Next-Gen SIEM on my alert volume and false positives has been significant, as it consolidates data in one platform and helps remove false positive detections with the assistance of the Falcon Complete team.

Having Falcon telemetry integrated with my other security data sources within the SIEM improves my security operations by reducing overload and allowing me to correlate logs from Zscaler with those from Palo Alto, enriching data and lowering false positives.

These automations change the work that my SOC analysts perform day-to-day by reducing time spent on repetitive tasks and allowing them to focus on tasks that require human intervention, such as contacting appropriate team members.

The feature of CrowdStrike Falcon Next-Gen SIEM that I like the most is the advanced search, which works smoothly without hanging, allows manipulation of a huge amount of data, and returns results within seconds.

I use automations within CrowdStrike Falcon Next-Gen SIEM, building workflows and agents to merge my solutions, searches, and responses.

I use Charlotte AI within CrowdStrike Falcon Next-Gen SIEM to create summaries of events for analysts, automate email notifications for detections, and add human-in-the-loop actions to prompt approvals or rejections.

I think CrowdStrike Falcon Next-Gen SIEM could be improved in the way lookup tables work, particularly concerning the limitations of the number of rows, and enhancements in workflow creation to make it more intuitive and easier to manage searches from within workflows.

I have been using CrowdStrike Falcon Next-Gen SIEM for four years.

In terms of stability and reliability, I find that CrowdStrike Falcon Next-Gen SIEM performs really well and I have not experienced any issues, downtimes, or delays—it works smoothly.

Regarding scaling with my company's needs, I believe the tool expands with pre-built actions for workflows, showing improvement, even if I cannot comment on features like the parser or apps as I am not using those actively.

My overall experience with CrowdStrike support has been positive, as I have always received timely responses through my message center and community resources when needed.

Before transitioning to CrowdStrike Falcon Next-Gen SIEM, I used Splunk, and I recently switched to this new solution.

I switched to CrowdStrike Falcon Next-Gen SIEM to merge my solutions and avoid using different vendors, considering factors like cost and the new development of CrowdStrike Falcon Next-Gen SIEM compared to previous solutions like Humio and LogScale.

I was not involved in the deployment of CrowdStrike Falcon Next-Gen SIEM, so I cannot share my experience, although I think using a tool like Cribl for data ingestion may present opportunities for improvement.

On a scale of one to ten, I would rate CrowdStrike Falcon Next-Gen SIEM a strong seven, as I see plenty of room for improvement in workflow creation despite good progress in areas like responses and AI capabilities.