CrowdStrike enables new capabilities to improve security operations

CrowdStrike has announced enhancements to the CrowdStrike Falcon platform that significantly improve Security Operations Center (SOC) efficiency and effectiveness, allowing security teams to focus on critical priorities and fortify their organizations' proactive stance against cyber threats.

CrowdStrike customers can accelerate their security operational response with new notification workflows and Real Time Response (RTR) capabilities within the CrowdStrike Falcon platform, automating full-cycle incident response. These advancements are complemented by new user interface (UI) enhancements that let analysts visualize the relationship between detections and incidents, allowing them to update an incident and its associated detections at the same time. The new capabilities help SOCs to optimize their operations to meet CrowdStrike’s 1/10/60 response rule, prescribing one minute for security teams to detect an attack, 10 minutes to understand it and 60 minutes to contain it.

Patrick McCormack, Senior Vice President of Cloud Engineering at CrowdStrike, says, “Security teams today are overwhelmed by the expanded attack volume, disparate alert notifications and complex security workflows. CrowdStrike has always focused on improving the efficacy and speed of security operations. These new capabilities enable teams to orient more quickly to the detections and incidents that matter and to handle known situations with automation, reducing workload overhead and alert fatigue. The right teams now get the right information via the right tools with less distractions for faster and more focused triage and response.”

The new CrowdStrike UI enhancements move the SOC workflow to a proactive incident-based workflow by allowing customers to view, assign, update the status of and comment on related detections. Customers can streamline their SOC operations with the new CrowdStrike Falcon notification workflows that provide automated real-time notifications tailored to specific types of events, conditions and cloud security posture findings and then be seamlessly delivered via email, generic webhooks or through Slack and PagerDuty integrations.

The power of CrowdStrike’s cloud-native and single-agent architecture means that customers can use the RTR framework through CrowdStrike Store apps without needing to update agents or deploy and configure new software to automate response actions. CrowdStrike customers can now deploy automated security, response and vulnerability remediation playbooks from CrowdStrike Store partners, such as recently launched Tines and Vulcan Cyber, to leverage detections and incidents from the Falcon platform, and bring speed, consistency and scale to distributed SOC teams.