CrowdStrike Falcon Next-Gen SIEM Reviews

I work on Identity Governance for this solution. We onboard the logs into the SIEM, into CrowdStrike Falcon, and we ensure that we get alerts on time and create dashboards using that data. Our work is basically log onboarding.

Everything is flowing compared to how long it was before. Probably in two minutes, you can get the data.

CrowdStrike Falcon Next-Gen SIEM is a very vast tool, and while we discussed it, it can be used for many purposes, but we are using it only for the log onboarding at this point. That solved my purpose and it really helps me in finding the root cause of an error or a problem. Logging into servers and finding out and tracing information on multiple servers is difficult. With a search field or query where you can filter, you can get the data instantly. That is great.

While we are onboarding our logs, we can see the timeline where the error was happening, and then we were able to troubleshoot following the timeline in the thread. The search was easy, and we were able to investigate and find the errors correctly.

It reduces the time to log in to servers to see what is going on since everything is in one place. We have multiple servers, so that saves a lot of time in not logging in.

CrowdStrike Falcon Next-Gen SIEM has a capability to scale very long, which I feel will continue with the new features that are coming out.

False positives and workload definitely have an impact on alert volume and analysis workload. It reduces stress and improves efficiency and tracking mechanisms. Trying to resolve things makes it efficient.

Alert volume is impacted. It is very interesting. Very recently, I have been using a browser in one of the servers and that triggered an alert immediately because we did not know what the browser was doing in the back-end. I could see that it is using its plug-in or its cookies or communicating with different various sites. I got an alert and was shocked to see what was going on in the back. I just loaded it, installed Chrome, and did not know what was going on. But when I got an alert, I saw that it was talking to Facebook, Google, and so many other things. Then I went there and looked at that alert, and then I uninstalled that browser immediately. That was incredible. I appreciate that feature.

The only thing which I worked on is log onboarding, so I stick to that. It gives a lot of information with respect to the metrics or KPIs based upon the SIEM because you onboard your logs and see various features from an application-wise, showing what has been implemented. Showing that in the application is difficult, but showing it in the SIEM is pretty easy based upon what we do. That stands out for the usage.

I do not use automations within CrowdStrike Falcon Next-Gen SIEM at this point, but that is something that we want to do in the future.

Maybe I did not experiment or did not investigate, but if we can get alerts based upon the CPU utilizations and the metrics over there, probably that would make this one tool used for everything.

Actually, the circumstances that prompted my company to explore new SIEM solutions maybe include a point where the storage space or the license that we have, probably compared to other SIEM products, they have more, or the pricing and sales that go into the picture there. Again, that is above my pay grade to comment on, but it probably could be better if we can provide more storage of the data for the license that has been provided for organizations.

I work as an IAM engineer and have ten years in my current field.

So far, the stability and reliability of CrowdStrike Falcon Next-Gen SIEM is good. From my use, it has been pretty solid. I appreciate that there are different ways of integration that you can provide. It is not a situation where it has to be in a format or a different format. It can take everything and then normalize it and show it in a way that a user can understand.

CrowdStrike Falcon Next-Gen SIEM has a capability to scale very long, which I feel will continue with the new features that are coming out.

Support from CrowdStrike is not relevant for me.

There was Splunk before, and then it got migrated to CrowdStrike Falcon Next-Gen SIEM.

I have not been involved in the deployment of CrowdStrike Falcon Next-Gen SIEM.

The integration of CrowdStrike Falcon telemetry with other security data sources within the SIEM is something that the team can explain, but my usage is very limited.

I have definitely seen a return on my investment with this solution.

Pricing, setup costs, and licensing of CrowdStrike Falcon Next-Gen SIEM is not my area.

There is Grafana, there is Dynatrace. There are many more SIEM tools that you can talk about. The only difference is the fact of looking at the thread and making graph relations and showing it visually. That stands out with CrowdStrike Falcon Next-Gen SIEM. But with respect to other tools, what is lacking, I do not know. Maybe I did not experiment or did not investigate, but if we can get alerts based upon the CPU utilizations and the metrics over there, probably that would make this one tool used for everything.

I have been attending some sessions to see how we can use CrowdStrike Falcon Next-Gen SIEM more. I appreciate the Charlotte AI, the agentic thing. Probably we will try to see what is going on there. The team is already doing the infrastructure management using CrowdStrike Falcon Next-Gen SIEM. That is not my expertise there, but there is something that I can still let the team know about this new development.

I just got to learn about Charlotte AI yesterday in the session, and that is very interesting where you can track the core workstation to actual incident and the adversaries. That is interesting. That is probably something that I want to explore.

CrowdStrike Falcon Next-Gen SIEM is a vast tool. It has everything from basic to advanced. The documentation is very vast, so that is one thing that you need to go through and try to understand, because the terminology used is niche.

In the majority, this is true. I am actually trying to clear a certification from CrowdStrike, so I am preparing for that. Learning through the documentation is much more useful. It is pretty nice. My overall rating for this solution is ten out of ten.

My main use case for CrowdStrike Falcon Next-Gen SIEM is getting all of our log data together in one place that is very easy to search and filter through.

The feature I like the most about CrowdStrike Falcon Next-Gen SIEM is the speed.

CrowdStrike Falcon Next-Gen SIEM has changed the speed at which my team searches, investigates, and responds to security events, with things going from days to minutes or hours.

The integration of Falcon telemetry with other security data sources within CrowdStrike Falcon Next-Gen SIEM makes everything smoother and easier to see under a single pane of glass.

The number one thing that would be an improvement for me is making dashboard creation easier.

For the next release of CrowdStrike Falcon Next-Gen SIEM, I would suggest including data normalization, specifically a way to easily normalize data from different sources, as currently you can do it, but it is a little bit more labor-intensive.

I have been using CrowdStrike Falcon Next-Gen SIEM for three years.

I have not experienced any downtime, crashes, or performance issues with CrowdStrike Falcon Next-Gen SIEM.

I assess the stability and reliability of CrowdStrike Falcon Next-Gen SIEM as 10 out of 10.

CrowdStrike Falcon Next-Gen SIEM scales with the growing needs of my organization, and since we are a small to medium business, it is probably overkill as it stands. We could triple the size of our business and it would still probably be a little bit overkill.

I evaluate customer service and technical support for CrowdStrike Falcon Next-Gen SIEM as great. We have never had an issue, and if we ask, somebody answers quickly, either our account rep or if we submit a ticket, they are very quick about getting back to us.

The circumstances that prompted my organization to explore new SIEM solutions included not having one at all, hearing people expressing dissatisfaction with Splunk and others, and then seeing demos of CrowdStrike Falcon Next-Gen SIEM when it first came out. We thought that it seemed great because it pulls all of our telemetry data and gives us this volume of data to be stored for one year, three years, or whatever we want, automatically, and it is already in our portal with these other products that we use, EDP and Falcon Complete.

Although we did not have a SIEM previously, it would all be consolidated because it is what we have now.

I would describe my experience with deploying CrowdStrike Falcon Next-Gen SIEM as easy. Setting up, even for our firewall integrations, is all piping into a Cribl Transformer that pipes it all directly into CrowdStrike Falcon Next-Gen SIEM, which is very simple.

What worked well were the integrations. The challenges we faced were on the human side, specifically getting used to the query language and how to look for the data, but this is something you just pick up with time.

I have not seen return on investment with CrowdStrike Falcon Next-Gen SIEM because I am not a money person, so I cannot evaluate it in that way.

My experience with pricing, setup costs, and licensing for CrowdStrike Falcon Next-Gen SIEM was fine. It cost money, we paid, and it was good.

We have seen no impact on alert volume, false positives, or analyst workload because we do have Falcon Complete as well, so a lot of those alerts get handled by them.

In an investigation or incident where CrowdStrike Falcon Next-Gen SIEM played a significant role, there was no security incident, but we had plenty of investigative incidents where we were able to pull telemetry from not only the Falcon sensor but also our Microsoft Entra logs, our ExtraHop logs, and our Abnormal Email logs, all integrating together into CrowdStrike Falcon Next-Gen SIEM to get a full, clear picture of what was going on.

I do not use automations with CrowdStrike Falcon Next-Gen SIEM.

We are not using Charlotte AI or other AI capabilities within CrowdStrike Falcon Next-Gen SIEM.

This has given us visibility where we had none.

The expanded usage of CrowdStrike Falcon Next-Gen SIEM is just us using it more, and that process has been very smooth. We are starting to get a few dashboards together and a few saved queries together, and we know what we are looking for a little bit better with our data.

I would advise other organizations considering CrowdStrike Falcon Next-Gen SIEM to try it and run a proof of value and notice that the time it takes to return results is seconds compared to minutes with other SIEMs. When you try that once with your data set, you will be hooked.

I would rate this product 10 out of 10.

My main use cases for CrowdStrike Falcon Next-Gen SIEM include identifying and detecting threats.

The features of CrowdStrike Falcon Next-Gen SIEM that I appreciate most are lookup tables and functions.

The use of functions and lookup tables in CrowdStrike Falcon Next-Gen SIEM dramatically improves investigation outcomes because of reduced latency.

CrowdStrike Falcon Next-Gen SIEM has had a significant impact on alert volume, false positives, and analyst workload by using lookup tables to improve detection context.

The context and the ability to load information and store information in lookup tables is revolutionary in demonstrating the return on investment.

I believe CrowdStrike Falcon Next-Gen SIEM can be improved by continuing on the path it is on.

I would like to see more cat-themed threat actors included in the next release of CrowdStrike Falcon Next-Gen SIEM.

I have been using CrowdStrike Falcon Next-Gen SIEM for one year.

I would assess the stability and reliability of CrowdStrike Falcon Next-Gen SIEM as extremely high.

I have experienced very minimal downtime, crashes, or performance issues with CrowdStrike Falcon Next-Gen SIEM.

CrowdStrike Falcon Next-Gen SIEM scales effectively with the growing needs of my organization.

We have not expanded usage of CrowdStrike Falcon Next-Gen SIEM, and the process was smooth.

I would evaluate customer service and technical support for CrowdStrike Falcon Next-Gen SIEM as great.

What makes the customer service great is that support is both technically sound and empathetic in their understanding of different situations.

The circumstances that prompted my organization to explore new SIEM solutions include modernity and flexibility.

I have been able to consolidate or replace legacy SIEM, SOAR, or other SOC tools.

I would describe my experience with deploying CrowdStrike Falcon Next-Gen SIEM as thorough.

I have seen a return on investment with CrowdStrike Falcon Next-Gen SIEM.

The impact of this consolidation has resulted in greater team cohesion, greater team efficacy, and greater speed of response.

We do not use Charlotte AI or other AI capabilities within CrowdStrike Falcon Next-Gen SIEM.

Automations in CrowdStrike Falcon Next-Gen SIEM have increased the confidence my SOC analysts have in making decisions.

CrowdStrike Falcon Next-Gen SIEM played a significant role in an investigation or incident by functioning best at responding to incidents relating to specific identity compromise and correlating different data from different sources to make identity-related threats easier to mitigate and identify.

My advice to other organizations considering CrowdStrike Falcon Next-Gen SIEM is to not be afraid of the monoculture and to embrace it wholeheartedly.

I have given this review an overall rating of eight.

My main use cases for CrowdStrike Falcon Next-Gen SIEM are SOC and EDR, and there are many applications. In an investigation where CrowdStrike Falcon Next-Gen SIEM played a significant role, I was tracking the attackers and performing city operations, such as executing PowerShell scripts or investigating anomalous behaviors.

I think everything is good about CrowdStrike Falcon Next-Gen SIEM, as we have many features available.

CrowdStrike Falcon Next-Gen SIEM has changed the speed at which my team searches, investigates, and responds to security events significantly, as it triggers really fast, allowing us to capture the logs and determine the problem or the alerts.

The impact of CrowdStrike Falcon Next-Gen SIEM on alert volume, false positives, and my analyst workload is that there are fewer false positives, so mainly all alerts are true positives.

Regarding additional features that should be included in the next release, there was something new, such as a Mind or something similar, which may be a good addition.

I have been using CrowdStrike Falcon Next-Gen SIEM for three to four years.

I would describe the stability and reliability of CrowdStrike Falcon Next-Gen SIEM as really good, as it is stable and reliable, triggering everything and figuring out everything, so it saves a lot of time.

I have experienced downtime, crashes, or performance issues one time. That downtime was one that everybody knows about.

I would say that CrowdStrike Falcon Next-Gen SIEM scales with the growing needs of my organization, and it is important. I have expanded usage, and the process has always been smooth and really easy to use.

I evaluate customer service and technical support by saying that I am not on the right team to answer this, but I think the technical support and customer support are really good because I have not seen any problems.

The circumstances that prompted my organization to explore new SIEM solutions included all the attacks that were going on, so there would be new attacks triggering it out at first. We needed CrowdStrike or CrowdStrike Falcon Next-Gen SIEM.

I have no information about my experience with deploying CrowdStrike Falcon Next-Gen SIEM; perhaps the SOC team knows better.

I may use automations within CrowdStrike Falcon Next-Gen SIEM, but since I am on the AppSec side, the SOC team may know more about it.

Automations have changed the work my SOC analysts perform day-to-day, as conducting manual triage for all our logs is really difficult, so it is obviously doing a great job and making life easier.

I do not see any quantifiable improvements in detection, investigation, or response times since deploying CrowdStrike Falcon Next-Gen SIEM.

For the integration of Falcon Telemetry with other security data sources within CrowdStrike Falcon Next-Gen SIEM, I have to look into it.

I have not tried using Charlotte AI or other AI capabilities within CrowdStrike Falcon Next-Gen SIEM.

I have no information about whether I have been able to consolidate or replace legacy SIEM, SOAR, or other SOC tools.

The advice I would give to other organizations considering CrowdStrike Falcon Next-Gen SIEM is that you should choose CrowdStrike. I would rate this product a ten out of ten.