CrowdStrike Falcon Next-Gen SIEM Reviews

My main use case for CrowdStrike Falcon Next-Gen SIEM is to manage SIEM and endpoints.

As a SOC Analyst, I use the Falcon endpoint sensor on all of our hosts, devices, and servers to monitor detections, endpoint telemetry, server logs, network connections, and any execution activity happening on them. This represents our day-to-day daily alerts.

I use CrowdStrike Falcon Next-Gen SIEM to monitor, detect, and respond to all kinds of threats occurring on our endpoints, including hosts and servers.

I received an alert involving suspicious activity on an endpoint, and my first step was to investigate the alert and search for related activity in CrowdStrike Falcon Next-Gen SIEM. It helped me establish the scope of the activity, identify related indicators, and determine whether escalation was required, or I could contain the event with a one-click action. The biggest value of Falcon in that type of investigation is centralized visibility.

I am not using Charlotte AI as of now, but it is something in our future plan as I would like to explore and understand Charlotte AI.

The biggest positive impact CrowdStrike Falcon Next-Gen SIEM has on my organization is improved visibility, operational efficiency, and faster security response. From the SOC perspective, having security logs and telemetry available in a centralized platform makes it easier to investigate suspicious activities and correlate events across different sources, helping with incident prioritization, faster triage, and more informed escalation decisions. In terms of measurable outcomes, I look at metrics such as mean time to detect and mean time to respond, which have improved, and the improved visibility and process are the biggest benefits that have added great value to my company since we migrated to CrowdStrike.

From an operational perspective, the biggest improvement is in investigation and response. Having centralized log visibility and the ability to search and complete events helps analysts identify relevant information much faster, making the improvement noticeable, particularly during initial triage. The overall benefit is that analysts can investigate faster and prioritize incidents more effectively compared to any other security EDR tools available.

From an operational perspective, I have seen improvements in the investigation and response workflow. The biggest advantage is that CrowdStrike Falcon Next-Gen SIEM provides centralized visibility into security events, which helps analysts quickly identify related activities and investigate suspicious behavior. I have endpoint telemetry, endpoint activities, process trees, and search logs all in one place, which is a unique feature that other platforms lack.

CrowdStrike Falcon Next-Gen SIEM has improved the speed of the workflow, particularly when dealing with multiple events. It has unique layers of approach, especially in the process tree and alert investigation time.

The best features CrowdStrike Falcon Next-Gen SIEM offers include endpoint activities and investigation capabilities, specifically the ability to investigate, understand the process, process tree, and suspicious behavior during incident response. I appreciate this because it is very convenient and makes an analyst's response fast.

The biggest benefit is the visibility and ability to investigate. For example, when I receive a suspicious activity alert, instead of manually checking multiple data sources, I can use the SIEM search capabilities to look for related events, examine timestamps, identify affected systems, and correlate activities. Overall, it makes the investigation process more efficient and gives me better visibility as a SOC analyst.

I appreciate CrowdStrike for its data visibility, detection capabilities, threat investigation, and dashboards.

I think the AI capabilities in CrowdStrike Falcon Next-Gen SIEM are incredible, as it has strong governance and a security platform, making it one of the most powerful platforms available.

I think the AI capabilities in CrowdStrike Falcon Next-Gen SIEM can be very useful, especially for assisting analysts in threat investigation and understanding threat actor motives through the MITRE ATT&CK framework. It reduces manual effort. Recently, they launched Guardian, an AI agent that can improve detection and response time and has a kill switch if it goes rogue. However, I do not think the output should be treated as completely authoritative, as there can be situations where the context is incomplete or the output needs further validation.

CrowdStrike Falcon Next-Gen SIEM is an incredible tool with powerful platforms, but I would like to see improvements in dashboard customization and reporting. Having more flexibility to create role-based dashboards and custom reports would help SOC teams monitor effectively. I believe log onboarding and parsing could be made much simpler, as it can be very difficult for beginners to understand and integrate these third-party data sources. A much simpler UI can help.

I have been using CrowdStrike Falcon Next-Gen SIEM for eight months.

I have experienced stability issues.

I have direct contact with the CrowdStrike team, who are always helpful and there for any issues, so I would say the service is fantastic.

I would rate the customer support a ten.

As I mentioned earlier, I lacked capabilities in Carbon Black to have centralized visibility and review multiple events. There was also a lot of noise, false positives, and detections that were not helping analysts to review. Due to the limitation of available resources, I had to explore the top tool in the market. CrowdStrike was evolving, offering great features, unique capabilities, and AI-agentic workflows, with insanely good detection response time, which is why I had to switch to CrowdStrike.

It was Carbon Black, which I mentioned had limitations on centralized visibility and a lot of noise from false positive detections that were not helping analysts.

I can assure you I do see a return on investment, which is great because I have been seeing improvements in detection time, response, and time savings. I would say that is one of the best returns on investment I have seen so far. I have reduced a lot of false positives and made my tuning much stronger and impactful.

I would rate CrowdStrike Falcon Next-Gen SIEM a nine due to its highly advantaged market demand over others and its unique features, though there is always room for improvement, especially to make it much easier for beginners. The ease of use for beginners is mainly why I did not choose a ten.

I think CrowdStrike Falcon Next-Gen SIEM is deployed in a public cloud, possibly Azure or AWS, but I work as an analyst, which is why I do not have much information. It should be both, as far as I am aware.

To look at and approach the product, evaluate risk and reward in your environment. I would definitely recommend them to make a switch because of the unique capabilities and detection improvements.

Public Cloud

My main use case for CrowdStrike Falcon Next-Gen SIEM is log aggregation. I specifically use CrowdStrike Falcon Next-Gen SIEM for log aggregation with cloud security logs and EDR logs.

I am not aware of using automations within CrowdStrike Falcon Next-Gen SIEM, but I am sure the CERT team and SOC team have tried some automation.

CrowdStrike Falcon Next-Gen SIEM has positively impacted my organization by reducing analyst workload and saving time for response, making them more eager to work and resulting in less fatigue.

My analysts can now spend more time learning new AI concepts and models, as they have more bandwidth because CrowdStrike Falcon Next-Gen SIEM does most of the work, requiring only human intervention to analyze and remediate detections or alerts.

Since deploying CrowdStrike Falcon Next-Gen SIEM, I have definitely seen around a 50% improvement in detection time and response time.

CrowdStrike Falcon Next-Gen SIEM has drastically changed the speed at which my team searches, investigates, and responds to security events, enabling analysts to save quite a bit of time, around 70% I would say, and making our ways of working more efficient.

CrowdStrike Falcon Next-Gen SIEM has had a positive impact on alert volume, false positives, and analyst workload, as the alert volume has aggregated, allowing analysts to have more time at their disposal.

The integration of CrowdStrike Falcon Next-Gen SIEM telemetry with other security data sources has made operations much easier, as previously it was complex to handle multiple tools and technologies. Now, aggregation into one platform has enabled analysts to save time.

Since adopting CrowdStrike Falcon Next-Gen SIEM, it has been impactful in consolidating or replacing legacy SIEM, SOAR, or other SOC tools.

CrowdStrike Falcon Next-Gen SIEM's best features, in my experience, come from the SOC team that uses it. They have provided positive feedback that they can get all logs in one place, which improves their investigations.

CrowdStrike Falcon Next-Gen SIEM's dashboard is interesting because they can see many alerts and detections that can be tagged, providing a good way to view them.

CrowdStrike Falcon Next-Gen SIEM's compatibility and ease of use are notable. It is easy to navigate and does not take much time during an investigation.

Regarding CrowdStrike Falcon Next-Gen SIEM's AI capabilities, I believe the platform has very good console permissions that separate user privileges across distinct workflows such as data onboarding, detection engineering, and log enrichment.

I just started my AI journey with CrowdStrike Falcon Next-Gen SIEM, so I am still evaluating it. From the feedback I have received, the security guardrails are very good and are improving.

High-speed threat hunting with CrowdStrike Falcon Next-Gen SIEM has been very good because I have observed better response times. Third-party telemetry integration between Defender, Sentinel, and major firewalls works well without any duplicate alerts.

I am not aware of any specific improvements needed for CrowdStrike Falcon Next-Gen SIEM, as I have a very good support team and account manager from CrowdStrike, ensuring I always receive updates instantly.

CrowdStrike Falcon Next-Gen SIEM could be improved by suggesting additional use cases depending on the environment.

I do not think there have been any improvements needed that my team would like to see in CrowdStrike Falcon Next-Gen SIEM.

I have been using CrowdStrike Falcon Next-Gen SIEM for two years.

The factors that prompted my organization to explore new SIEM solutions like CrowdStrike Falcon Next-Gen SIEM stem from the fact that we have been using CrowdStrike EDR for some time, making Falcon Next-Gen the next logical option.

I have seen a return on investment from using CrowdStrike Falcon Next-Gen SIEM, as my team size has improved and the same set of people can do more tasks apart from incident response.

My experience with pricing, setup cost, and licensing for CrowdStrike Falcon Next-Gen SIEM has been moderate, and there is room for improvement in pricing.

My organization did not evaluate other options before choosing CrowdStrike Falcon Next-Gen SIEM, as it was clear that since we were using EDR, the next move was to have the next-gen SIEM.

I rate CrowdStrike Falcon Next-Gen SIEM a nine on a scale of one to ten. I choose to give it a nine because there should always be room for improvement in the product, and a nine means there is scope for improvements, which is my personal feeling.

On-premises

My main use cases for CrowdStrike Falcon Next-Gen SIEM include identifying and detecting threats.

The features of CrowdStrike Falcon Next-Gen SIEM that I appreciate most are lookup tables and functions.

The use of functions and lookup tables in CrowdStrike Falcon Next-Gen SIEM dramatically improves investigation outcomes because of reduced latency.

CrowdStrike Falcon Next-Gen SIEM has had a significant impact on alert volume, false positives, and analyst workload by using lookup tables to improve detection context.

The context and the ability to load information and store information in lookup tables is revolutionary in demonstrating the return on investment.

I believe CrowdStrike Falcon Next-Gen SIEM can be improved by continuing on the path it is on.

I would like to see more cat-themed threat actors included in the next release of CrowdStrike Falcon Next-Gen SIEM.

I have been using CrowdStrike Falcon Next-Gen SIEM for one year.

I would assess the stability and reliability of CrowdStrike Falcon Next-Gen SIEM as extremely high.

I have experienced very minimal downtime, crashes, or performance issues with CrowdStrike Falcon Next-Gen SIEM.

CrowdStrike Falcon Next-Gen SIEM scales effectively with the growing needs of my organization.

We have not expanded usage of CrowdStrike Falcon Next-Gen SIEM, and the process was smooth.

I would evaluate customer service and technical support for CrowdStrike Falcon Next-Gen SIEM as great.

What makes the customer service great is that support is both technically sound and empathetic in their understanding of different situations.

The circumstances that prompted my organization to explore new SIEM solutions include modernity and flexibility.

I have been able to consolidate or replace legacy SIEM, SOAR, or other SOC tools.

I would describe my experience with deploying CrowdStrike Falcon Next-Gen SIEM as thorough.

I have seen a return on investment with CrowdStrike Falcon Next-Gen SIEM.

The impact of this consolidation has resulted in greater team cohesion, greater team efficacy, and greater speed of response.

We do not use Charlotte AI or other AI capabilities within CrowdStrike Falcon Next-Gen SIEM.

Automations in CrowdStrike Falcon Next-Gen SIEM have increased the confidence my SOC analysts have in making decisions.

CrowdStrike Falcon Next-Gen SIEM played a significant role in an investigation or incident by functioning best at responding to incidents relating to specific identity compromise and correlating different data from different sources to make identity-related threats easier to mitigate and identify.

My advice to other organizations considering CrowdStrike Falcon Next-Gen SIEM is to not be afraid of the monoculture and to embrace it wholeheartedly.

I have given this review an overall rating of eight.

My main use case for CrowdStrike Falcon Next-Gen SIEM at Bodycote is detection engineering, detection, threat detection, and threat landscape.

My use case involves fusion, so I create detections based on real-life threats.

I am using Charlotte AI or other AI capabilities within CrowdStrike Falcon Next-Gen SIEM to write detections.

CrowdStrike Falcon Next-Gen SIEM has positively impacted my organization because it has brought a toolset alignment, and we have been able to detect and respond quicker and see what is actively happening in our network.

We are currently still setting up the estate on the SIEM.

CrowdStrike Falcon Next-Gen SIEM has changed the speed at which my team searches, investigates, and responds to security events very much quicker. The C2L is much easier to use, and I need to see what is on the estate.

The impact on alert volume, false positives, or analyst workload with CrowdStrike Falcon Next-Gen SIEM is that analyst workload has reduced significantly.

The integration of CrowdStrike Falcon Next-Gen SIEM telemetry with other security data sources within the SIEM has provided full visibility into what is happening in our estate.

The best features CrowdStrike Falcon Next-Gen SIEM offers are quick lead times to detect and respond.

Those quick detection and response times with CrowdStrike Falcon Next-Gen SIEM are very fast compared to previous detection times with previous rules. Manual hunting is now not required.

Regarding CrowdStrike Falcon Next-Gen SIEM's AI capabilities, I think its governance and security is very strong and I have assurance with that.

Concerning CrowdStrike Falcon Next-Gen SIEM's AI capabilities, I find it strong, and the outputs are very accurate.

I use automations within CrowdStrike Falcon Next-Gen SIEM, and they reduce false positives significantly.

CrowdStrike Falcon Next-Gen SIEM can be improved by being more user-friendly.

The needed improvement for CrowdStrike Falcon Next-Gen SIEM is that the interface could be more friendly in terms of visibility and offer a bit more customization.

I have been using CrowdStrike Falcon Next-Gen SIEM for about six months now. I have experience in using it previously in a previous role.

We have been using CrowdStrike Falcon Next-Gen SIEM for a much shorter period of time.

CrowdStrike Falcon Next-Gen SIEM is very stable.

The scalability of CrowdStrike Falcon Next-Gen SIEM is massive. I can build the platform out how I want it.

The customer support for CrowdStrike Falcon Next-Gen SIEM is excellent.

On a scale of one to ten, I would give the customer support a ten.

The circumstances that prompted my organization to explore new SIEM solutions were more visibility.

I did not previously use a different solution, so we needed visibility.

I have not been able to consolidate or replace legacy SIEM, SOAR, or other SOC tools, and there has been no financial impact.

Before choosing CrowdStrike Falcon Next-Gen SIEM, we did not evaluate other options.

On a scale of one to ten, I would rate CrowdStrike Falcon Next-Gen SIEM a nine.

I chose a nine because of the user interface.

CrowdStrike Falcon Next-Gen SIEM is deployed in my organization in the cloud.

We use Azure as our cloud provider.

My advice to others looking into using CrowdStrike Falcon Next-Gen SIEM is to go with it because of the visibility of your estate.

Microsoft Azure

My main use case for CrowdStrike Falcon Next-Gen SIEM is that I am an administrator of CrowdStrike Falcon Next-Gen SIEM.

As an administrator using CrowdStrike Falcon Next-Gen SIEM, I handle integrations of data sources, configuration of Falcon LogScale Collectors, log parsing, normalization of logs and mapping logs to CrowdStrike's common schema, and platform maintenance, which includes workflows for detecting errors in the platform.

CrowdStrike Falcon Next-Gen SIEM has a positive impact on my organization because the platform improves the time it takes to perform the integration itself and reduces the time for configuring parsing and mapping to CrowdStrike's data schema, which makes onboarding more agile. Additionally, by default it has a large library of available connectors for a large number of technologies to integrate, which means that when creating use cases or rules, there is a broad range of technologies.

In the project where I am working, a migration from another SIEM has been carried out, so currently we are just collecting data about the efficiency of the new CrowdStrike platform.

One of the features offered by CrowdStrike Falcon Next-Gen SIEM that is quite useful is Fleet Manager Management, from which I can manage and deploy configurations to LogScale Collectors remotely without needing access to the machines where I collect logs. On the other hand, the connectors part is very interactive; it is easy to configure, very well documented in CrowdStrike documentation, and it is a user-friendly platform for users who do not have much experience with CrowdStrike.

In general, these features make my work easier because I do not need direct access to the machines, and I can do all the configuration of inputs and sinks from the Fleet Management portal.

I think CrowdStrike Falcon Next-Gen SIEM could be improved with optimization of the internal audit process because today not all internal metrics are reflected in CrowdStrike's internal logs in the internal log repositories. Having this execution data for workflows and execution of use cases would be very useful to detect possible errors or possible failures in the platform.

I would like to see an improved ability to have greater control over the health of the platform through AI agents, such as an agent that advises me or notifies me what changes have happened since my last login to the platform, what has changed, what errors it has detected, what connector or parsing failures there have been, and that it gives me a prioritization approach indicating which of these failures are more important and where I should start applying fixes or resolving them.

I have been using CrowdStrike Falcon Next-Gen SIEM for six months.

I consider CrowdStrike Falcon Next-Gen SIEM a stable platform.

I consider the scalability of CrowdStrike Falcon Next-Gen SIEM favorable and something that can be achieved in an agile way.

I rate CrowdStrike Falcon Next-Gen SIEM's customer support as good. In some cases, they take time to answer questions, but in general if it is something urgent, they reply quite quickly.

I have replaced Splunk SIEM with CrowdStrike Falcon Next-Gen SIEM.

I give it a seven because it is quite a complete platform. The fact of having EDR, XDR, SOAR—workflows in this case—and NG SIEM in the same portal, plus Cloud Security and Identity Security, is very useful and significantly reduces the time to create use cases and broadens security in terms of being able to cover as many technologies as possible within the organization. However, it still lacks maturity in some management areas, such as in workflows, especially having traceability of how, how often, and how connectors, workflows, and other NG SIEM components are being executed.

I have a good opinion about the governance and security of artificial intelligence in CrowdStrike Falcon Next-Gen SIEM.

I perceive the accuracy and reliability of the results offered by CrowdStrike Falcon Next-Gen SIEM's artificial intelligence as quite high.

I would advise other professionals considering using CrowdStrike Falcon Next-Gen SIEM to clearly set the prioritization of onboardings and make a complete plan for prioritizing the onboarding of organizational technologies into NG SIEM. From there, plan the deployments of LogScale Collectors and other components.

Public Cloud

Amazon Web Services (AWS)

My main use case for CrowdStrike Falcon Next-Gen SIEM is collecting logs and performing reviews and automatic analysis. On top of that, I implement workflows for customer notifications and automation.

For example, I have security products installed on devices, and I gather logs from those security products into CrowdStrike Falcon Next-Gen SIEM where I have specific rules. If a USB is detected and blocked, I run a workflow which informs the customer that a USB has been unauthorizedly inserted into their device.

I also use CrowdStrike Falcon Next-Gen SIEM for issues related to viruses and IPS and IDS, implementing the same workflow.

For example, we utilized CrowdStrike Falcon Next-Gen SIEM recently when a customer had a penetration test. We had some alerts and then discovered it was a penetration test because of the logs.

I use automations within CrowdStrike Falcon Next-Gen SIEM, and we implemented existing automations when we set up the SIEM. Basically, it sends emails and other notifications.

CrowdStrike Falcon Next-Gen SIEM has positively impacted my organization as it is a revenue-generating service because we sell it to customers.

My team is basically platform operations and we delegate all incident response to the actual customer.

I have seen approximately 10 to 15 percent improvements in detection, investigation, or response time since deploying CrowdStrike Falcon Next-Gen SIEM.

CrowdStrike Falcon Next-Gen SIEM did not change the speed at which my team searches, investigates, and responds to security events.

The impact has been basically the same in alert volume, false positives, or analyst workload because we re-implemented what we already had in a different system.

The integration of CrowdStrike Falcon Next-Gen SIEM telemetry with other security data sources within the SIEM has no impact on my security operations because we are quite specific in our approach.

The best features CrowdStrike Falcon Next-Gen SIEM offers are the search capability, which is really good, and the query language, which is quite flexible, along with good integration with the rest of the ecosystem.

The search and query language stand out for me because they are more flexible and composable compared to other tools I have used, such as QRadar or ArcSight.

I think CrowdStrike Falcon Next-Gen SIEM can be improved mainly in back-end stability because it is inconsistent. Sometimes what should have run does not. I suggest more reliability rather than new features.

I cannot think of any other improvements CrowdStrike Falcon Next-Gen SIEM needs right now.

I have been using CrowdStrike Falcon Next-Gen SIEM for three years.

I chose eight out of ten because I took points down due to some issues. Generally, support response is usually, 'Okay, but we cannot do that because...' For example, when something goes wrong, such as the back-end fails to implement something, and we contact support requesting that something be re-triggered or rerun, they say, 'We are not technically able to do that.'

We moved from QRadar to CrowdStrike Falcon Next-Gen SIEM because QRadar was being sold off and decommissioned, and that had a significant impact.

I would rate CrowdStrike Falcon Next-Gen SIEM an eight out of ten.

CrowdStrike Falcon Next-Gen SIEM is deployed in my organization in a public cloud environment, specifically the CrowdStrike cloud vendor.

My advice for others looking into using CrowdStrike Falcon Next-Gen SIEM is to get professional services and good support contracts.

Public Cloud

Other

My main use case for CrowdStrike Falcon Next-Gen SIEM is the integration of our other vendors' products in order to get a unified platform for anomalies and alerts in general and then to be able to analyze them.

For example, I have connected our Zscaler tenant there and can thus access the log data from Zscaler and also execute bidirectional workflows in order to perform actions in the two different vendor tenants.

I would also like to add that there are other vendors such as Check Point, and we also have a bidirectional integration there in order to define conditional access rules in the firewall based on users.

CrowdStrike Falcon Next-Gen SIEM has had a very positive impact on my company, with the advantage being the much clearer visibility across platforms in order to break down the silos of the various vendors or the different sub-areas of the company that do not have a complete view of the company, and through CrowdStrike Falcon Next-Gen SIEM, we have the opportunity to map the entire company via one platform.

I can name specific results or measurable improvements that have resulted from the better visibility, such as faster response times and the ability to know what is currently happening in the company. It is very important to highlight the correlation with other XDR modules such as Check Point XDR, which already analyze the logs, but we would otherwise need someone who looks at these logs dedicatedly. This way we also get them into CrowdStrike Falcon Next-Gen SIEM and can then work through things centrally in one place with one team.

The best features that CrowdStrike Falcon Next-Gen SIEM offers are the extensive integration of different vendors using the simple option of a predefined data connector that already has a parser, and if not, via the HTTP Universal Connector, which makes integration very easy in every respect.

I mainly use the predefined data connectors, and depending on the vendor, all connectors there, whether it is Zscaler, Check Point, Microsoft, or others.

Regarding potential for optimization, I imagine more could be done with the platform itself through the consolidation of the different modules, so that you do not have to call up the same menu everywhere, such as Detections, but that this is also consolidated into the Next-Gen SIEM module.

I have been using CrowdStrike Falcon Next-Gen SIEM for two years within the company itself and currently in the service build-out for customers.

On a scale from one to ten, I would rate CrowdStrike Falcon Next-Gen SIEM a nine.

The decisive reason for me to give exactly this nine is because I currently have no suggestions for improvement, but you never know what will come in the future, so not a ten yet.

CrowdStrike Falcon Next-Gen SIEM is deployed in my company on-premises. I purchased CrowdStrike Falcon Next-Gen SIEM through the channel manager as a direct partner.

On-premises

CrowdStrike Falcon Next-Gen SIEM's main use case in my company is handling malicious events that occur. A concrete example is events like a clicked phishing link and subsequent lateral movements if such an incident occurs and the user has entered their compromised data. I can trace those events there.

I can sometimes trace network events when using CrowdStrike Falcon Next-Gen SIEM. I can describe an incident in which CrowdStrike Falcon Next-Gen SIEM played a crucial role with Perpetual, the latest security threat that was published. I could view it in CrowdStrike, but in a very limited way. Still, with a few applications, I could see it.

CrowdStrike Falcon Next-Gen SIEM has positively impacted my company with faster incident handling.

My company was able to measurably improve detection, investigation, and response time through the use of CrowdStrike Falcon Next-Gen SIEM.

CrowdStrike Falcon Next-Gen SIEM has changed the speed at which my team searches for, investigates, and responds to security events, as it has improved this process.

CrowdStrike Falcon Next-Gen SIEM has had a positive impact on alert volume by reducing false positives and reducing the workload of my analysts.

The integration of different sources in CrowdStrike Falcon Next-Gen SIEM is particularly important to me so that I have multiple connections and can drive log analysis further.

Multiple accesses in CrowdStrike Falcon Next-Gen SIEM make my daily work easier, as different applications are connected.

I rate the governance and security in relation to the AI features of CrowdStrike Falcon Next-Gen SIEM as good.

I assess the accuracy and reliability of the AI-supported results in CrowdStrike Falcon Next-Gen SIEM as very good.

I do not have any specific suggestions for improvement on how the documentation or clarity in CrowdStrike Falcon Next-Gen SIEM could be optimized at this time.

From my point of view, there is no need for improvement in CrowdStrike Falcon Next-Gen SIEM that we have not yet discussed.

My company has been using CrowdStrike Falcon Next-Gen SIEM for about two to three years.

I rate CrowdStrike Falcon Next-Gen SIEM a 10 out of 10. I am giving it a 10 because CrowdStrike is the first SIEM application that I got to know and it represents so many products at once. This means I can practically get a lot of help and support and at the same time do not need to look for many other vendors. It is expensive, but still deserves a 10.

My advice to other companies considering using CrowdStrike Falcon Next-Gen SIEM is to combine it with multiple tools and not rely on a single source.

On-premises

My main use cases for CrowdStrike Falcon Next-Gen SIEM are SOC and EDR, and there are many applications. In an investigation where CrowdStrike Falcon Next-Gen SIEM played a significant role, I was tracking the attackers and performing city operations, such as executing PowerShell scripts or investigating anomalous behaviors.

I think everything is good about CrowdStrike Falcon Next-Gen SIEM, as we have many features available.

CrowdStrike Falcon Next-Gen SIEM has changed the speed at which my team searches, investigates, and responds to security events significantly, as it triggers really fast, allowing us to capture the logs and determine the problem or the alerts.

The impact of CrowdStrike Falcon Next-Gen SIEM on alert volume, false positives, and my analyst workload is that there are fewer false positives, so mainly all alerts are true positives.

Regarding additional features that should be included in the next release, there was something new, such as a Mind or something similar, which may be a good addition.

I have been using CrowdStrike Falcon Next-Gen SIEM for three to four years.

I would describe the stability and reliability of CrowdStrike Falcon Next-Gen SIEM as really good, as it is stable and reliable, triggering everything and figuring out everything, so it saves a lot of time.

I have experienced downtime, crashes, or performance issues one time. That downtime was one that everybody knows about.

I would say that CrowdStrike Falcon Next-Gen SIEM scales with the growing needs of my organization, and it is important. I have expanded usage, and the process has always been smooth and really easy to use.

I evaluate customer service and technical support by saying that I am not on the right team to answer this, but I think the technical support and customer support are really good because I have not seen any problems.

The circumstances that prompted my organization to explore new SIEM solutions included all the attacks that were going on, so there would be new attacks triggering it out at first. We needed CrowdStrike or CrowdStrike Falcon Next-Gen SIEM.

I have no information about my experience with deploying CrowdStrike Falcon Next-Gen SIEM; perhaps the SOC team knows better.

I may use automations within CrowdStrike Falcon Next-Gen SIEM, but since I am on the AppSec side, the SOC team may know more about it.

Automations have changed the work my SOC analysts perform day-to-day, as conducting manual triage for all our logs is really difficult, so it is obviously doing a great job and making life easier.

I do not see any quantifiable improvements in detection, investigation, or response times since deploying CrowdStrike Falcon Next-Gen SIEM.

For the integration of Falcon Telemetry with other security data sources within CrowdStrike Falcon Next-Gen SIEM, I have to look into it.

I have not tried using Charlotte AI or other AI capabilities within CrowdStrike Falcon Next-Gen SIEM.

I have no information about whether I have been able to consolidate or replace legacy SIEM, SOAR, or other SOC tools.

The advice I would give to other organizations considering CrowdStrike Falcon Next-Gen SIEM is that you should choose CrowdStrike. I would rate this product a ten out of ten.

My main use case for CrowdStrike Falcon Next-Gen SIEM is in the SOC. Within the SOC, I ingest all the infrastructure of a client and respond to their alerts in my day-to-day work.

CrowdStrike Falcon Next-Gen SIEM has positively impacted my organization by streamlining processes through the reduction of MTTD and MTTR.

I have noticed a reduced workload and false positives since using CrowdStrike Falcon Next-Gen SIEM.

I consider the best features that CrowdStrike Falcon Next-Gen SIEM offers to be its super-fast activation. This agility has made projects and daily operations much more efficient.

I use automations within CrowdStrike Falcon Next-Gen SIEM, which make the analysis and alert investigation easier for SOC analysts.

Regarding the artificial intelligence capabilities of CrowdStrike Falcon Next-Gen SIEM, I think its governance and security are correct. I think the accuracy and reliability of the results provided by the artificial intelligence are good.

I think CrowdStrike Falcon Next-Gen SIEM could improve with full integration with other tools.

I have been using this solution for three years.

I consider CrowdStrike Falcon Next-Gen SIEM to be a stable platform.

I would describe the scalability of CrowdStrike Falcon Next-Gen SIEM as total.

My experience with customer support for CrowdStrike Falcon Next-Gen SIEM has been all good.

The factors that led my organization or my client to look for a new SIEM solution like CrowdStrike Falcon Next-Gen SIEM are to simplify.

We have replaced the previous SIEM with CrowdStrike Falcon Next-Gen SIEM, but we still cannot quantify the impact.

Before using CrowdStrike Falcon Next-Gen SIEM, I was using Devo because of its efficiency.

Since using CrowdStrike Falcon Next-Gen SIEM, we have increased client trust and reduced response time.

My experience with the pricing, implementation cost, and licensing of CrowdStrike Falcon Next-Gen SIEM has been all good.

Before choosing CrowdStrike Falcon Next-Gen SIEM, I evaluated other options, including Palo Alto's SIEM.

I would rate CrowdStrike Falcon Next-Gen SIEM an eight on a scale from one to ten because it is not perfect, but it works very well.

CrowdStrike Falcon Next-Gen SIEM is deployed in my organization using a SaaS architecture.

My advice to those considering using CrowdStrike Falcon Next-Gen SIEM is that they should do it now.