CrowdStrike offers customers XDR capabilities

CrowdStrike, a cloud-delivered protection provider for endpoints, cloud workloads, identity and data, has announced that Falcon Insight is now Falcon Insight XDR, enabling all customers to leverage the power of native and hybrid extended detection and response (XDR) as a fundamental platform capability, without disruption to existing endpoint detection and response (EDR) capabilities or workflows.

CrowdStrike is also breaking down the silos that limit the value of native XDR approaches by further integrating third-party telemetry from CrowdXDR Alliance partners, which now include Cisco, ForgeRock and Fortinet as new members, and third-party vendors, which now include Microsoft and Palo Alto Networks. With this release, CrowdStrike is once again disrupting the XDR category, the company said.

CrowdStrike customers have been leveraging the CrowdStrike Falcon platform – a unified cloud-native security platform – for XDR use cases for years. CrowdStrike is now allowing all EDR customers to easily activate XDR capabilities within Falcon Insight XDR through simple-to-consume connector packs that unlock cross-domain detections, investigations and response actions across all key security domains from a unified console.

“Our XDR strategy has been clear from the beginning: bring the right information into the Falcon platform at the right time. With the introduction of Falcon Insight XDR, CrowdStrike is making it easier than ever for our customers to implement XDR and get EDR-like benefits from native integrations of other Falcon modules from the Falcon platform. And with the introduction of additional third-party integrations, including new CrowdXDR Alliance partners in Cisco, ForgeRock and Fortinet, we are empowering our customers to effectively and elegantly enrich a variety of data sources.

"By combining first-party and third-party integrations, security teams can create a detailed storyline on how an attack develops and progresses from detection to remediation. That’s the power of XDR and what we are delivering to our customers,” said Michael Sentonas, CTO, CrowdStrike.

Dave Gruber, Senior Analyst at Enterprise Strategy Group (ESG) stated: “The XDR movement continues to gain momentum as a strategy to detect, investigate and respond to increasingly more advanced threats across a rapidly growing, more complex attack surface. However, many are confused about what XDR is, what is needed to implement it and how to upgrade current tools stacks to incorporate it. 

"CrowdStrike’s XDR solution expands proven analytics, threat intelligence and EDR capabilities to further ingest and analyse signals from multiple threat vectors to detect more advanced threats. This enables security teams to leverage existing security tools strategies and investments, while expanding the scope and scale of detection and response programmes."

CrowdStrike is now:

Doubling down on third-party integrations

CrowdStrike is committed to supporting leading vendors across all key security domains – email, firewall, identity, network detection and response (NDR) and security service edge (SSE; both cloud access security brokers or CASBs and web) – to enrich detections, investigations and response actions. Falcon Insight XDR is continuing to add third-party integrations from CrowdXDR Alliance partners and third-party vendors, which now include Microsoft (for Microsoft 365 and Azure Active Directory) and Palo Alto Networks.

Deepening first-party integrations

Falcon platform customers who have Falcon Insight XDR and Falcon Cloud Workload Protection, Falcon Identity Threat Protection and/or Falcon for Mobile (EDR) can add the native XDR connector pack, which will be available at cost to ensure all CrowdStrike customers can leverage the platform’s native XDR capabilities.

Additionally, CrowdStrike is releasing new expert-developed detections including data from Falcon Identity Protection, as well as integrating additional telemetry from Falcon Horizon (cloud security posture management) and Falcon Spotlight (vulnerability management) into Falcon Insight XDR.

Supercharging the analytics experience 

Users get the context that matters most by the automatic highlighting of key findings during investigations, as well as through adding related intelligence to Falcon Insight XDR’s cross-domain graph explorer. These enhancements further speed the ability to drive faster, more accurate detection and response actions.

Extending integrated response with Zscaler

Falcon Insight XDR now integrates with Zscaler Zero Trust Exchange to drive response actions from XDR detections or via automated Falcon Fusion (security orchestration, automation, and response or SOAR) workflows. These automated response actions include limiting or updating user access to applications with adaptive access control policies based on detection criticality, providing full closed-loop remediation across platforms. 

Said Jessica Bair Oppenheimer, director of the Cisco Secure Technical Alliance at Cisco Systems: "Cisco is proud to join hands with CrowdStrike to help customers protect their business through valuable integrations that connect processes, tools and teams. An open approach to XDR is critical to keeping highly targeted and essential services like healthcare, transportation, utilities and others online and available to the billions of people who depend on them daily."

Peter Barker, Chief Product Officer, ForgeRock said: “Compromised credentials and account takeovers remain a top attack vector in security breaches. A comprehensive approach to protection requires cooperation among industry leaders, and we are excited to join the CrowdXDR Alliance. The integration of our identity threat detection and response capabilities with CrowdStrike will help organisations better protect against and combat these threats.”

John Maddison, CMO and EVP of products, Fortinet commented: “Fortinet has a longstanding commitment to collaborating with industry leaders that extends to more than 500 product integrations across security, cloud and networking via the Fortinet Fabric-Ready Technology Alliance Partner Program. We’re pleased to join the CrowdXDR Alliance and continue our legacy of fostering an open ecosystem of third-party integrations to support heterogeneous vendor environments and help customers improve visibility, reduce complexity, and simplify operations.

Details

Falcon Insight XDR enhancements are generally available for customers. Third-party and first-party integrations will be generally available by Q4FY23. The fiscal year for 2023 ends January 31, 2023.