What is our primary use case?
My cybersecurity strategy primarily involves using CrowdStrike Falcon as an EDR solution, and currently, we are using it as an EDR. We are in discussion with the CrowdStrike team about having a managed SOC integrated as well.
I am using CrowdStrike Falcon in the online industry.
What is most valuable?
The most effective feature I find for threat detection is the 24/7 managed monitoring, which is a next-gen antivirus and next-gen Endpoint Detection and Response. In Endpoint Detection and Response, the best part is 24/7, 365 continuous monitoring to the endpoint for identifying any suspicious activity.
It is a next-gen AV which does AI-based behavioral analysis to detect and take action on malware, ransomware, and other threats.
The automated response capabilities in CrowdStrike Falcon perform analysis based on the behavior of the activity. If it finds objectionable content or breaking of sitemaps, it uses an untraditional approach to block it. When suspicious activity occurs, such as detecting a file with a document extension that is self-replicating, the detection happens automatically. In cases of zero-day threats, such files are automatically put in sandbox for extraction and analysis to identify why it is classified as malware.
Falcon's integration capabilities with other tools enhance my security posture because it has a very lightweight agent, and having a unified console gives us complete visibility, including endpoints, servers, containers, and cloud workloads.
What needs improvement?
To improve CrowdStrike Falcon for the next release, I recommend that they should have a model where it works as an agentless solution. In terms of everything which agent pushes to the server or to the single console, if it could also have a feature where you can have other ports, which is SNMP or your network devices or OT devices, which you can specifically monitor, that would be great.
For how long have I used the solution?
I have been working with CrowdStrike Falcon for more than 2 years now.
What was my experience with deployment of the solution?
Regarding the setup, in my experience and our team's experience, it is fairly easy to install.
I would rate the setup an eight because we have a heterogeneous environment. For Windows, it is very straightforward and easy. For Linux, you need to automate it. If you have a bulk force, then you have to use some CMF or similar solution, which makes it a bit more complex, but overall it is fairly easy.
What do I think about the stability of the solution?
During these 2 years with CrowdStrike Falcon, I faced challenges, as everybody knows about the CrowdStrike outage. That was one significant issue, as it brought many Windows-related services to a halt due to one bad configuration push from CrowdStrike tracks.
Regarding stability, except for the incidents mentioned, I don't see any issues.
What do I think about the scalability of the solution?
For scalability, it is easy to scale this solution for my company needs, and I would rate it a nine.
More than 7,000 users are working with CrowdStrike Falcon in my company.
Currently, we are 100% covered with CrowdStrike Falcon, but as the user base increases, we will certainly increase the license.
How are customer service and support?
I have contacted CrowdStrike for support regarding the same incident, and my experience was pretty bad. There were people not knowing what was happening, how to mitigate it, or what to do. We were in a bad situation. After a couple of hours, their communication started flowing better, and things started improving.
My impression of the technical support of CrowdStrike, just for that particular instance, is less than four.
Which solution did I use previously and why did I switch?
I have evaluated other options before working with CrowdStrike, including Carbon Black and SentinelOne.
When comparing CrowdStrike and SentinelOne, I don't see many advantages, but because of one particular problem, we had to give away SentinelOne. Otherwise, all three products are quite comparable.
How was the initial setup?
Overall, it is a user-friendly tool.
What's my experience with pricing, setup cost, and licensing?
CrowdStrike Falcon is definitely an expensive solution.
What other advice do I have?
Since implementing CrowdStrike Falcon, I would say if it is protecting my environment, that fulfills my expectation. So far, I am happy.
For those who would to use CrowdStrike Falcon, I recommend that they need to negotiate hard on commercials because it is not an easy or affordable solution. From a commercial standpoint, they should negotiate hard. Technically, it is not a very difficult tool.
If we had not experienced that outage, I probably would have rated it ten. That incident gave it a very bad name because the support was inadequate. Many people might have decided to move out of CrowdStrike because of that incident.
My total rating for CrowdStrike Falcon is eight.
Disclosure: My company does not have a business relationship with this vendor other than being a customer.