CrowdStrike Falcon platform enhancements improve SOC efficiency

CrowdStrike announced enhancements to the CrowdStrike Falcon platform that significantly improve Security Operations Center (SOC) efficiency and effectiveness, allowing security teams to focus on critical priorities and fortify their organizations’ proactive stance against cyber threats.

CrowdStrike customers can accelerate their security operational response with new notification workflows and Real Time Response (RTR) capabilities within the CrowdStrike Falcon platform, automating full-cycle incident response.

These advancements are complemented by new user interface (UI) enhancements that let analysts visualize the relationship between detections and incidents, allowing them to update an incident and its associated detections at the same time.

The new capabilities help SOCs to optimize their operations to meet CrowdStrike’s 1/10/60 response rule, prescribing one minute for security teams to detect an attack, 10 minutes to understand it and 60 minutes to contain it.

“Security teams today are overwhelmed by the expanded attack volume, disparate alert notifications and complex security workflows,” said Patrick McCormack, senior vice president of Cloud Engineering at CrowdStrike.

“CrowdStrike has always focused on improving the efficacy and speed of security operations. These new capabilities enable teams to orient more quickly to the detections and incidents that matter and to handle known situations with automation, reducing workload overhead and alert fatigue.

“The right teams now get the right information via the right tools with less distractions for faster and more focused triage and response.”

The new CrowdStrike UI enhancements move the SOC workflow to a proactive incident-based workflow by allowing customers to view, assign, update the status of and comment on related detections.

Customers can streamline their SOC operations with the new CrowdStrike Falcon notification workflows that provide automated real-time notifications tailored to specific types of events, conditions and cloud security posture findings and then be seamlessly delivered via email, generic webhooks or through Slack and PagerDuty integrations.

The power of CrowdStrike’s cloud-native and single-agent architecture means that customers can use the RTR framework through CrowdStrike Store apps without needing to update agents or deploy and configure new software to automate response actions.

CrowdStrike customers can now deploy automated security, response and vulnerability remediation playbooks from CrowdStrike Store partners, such as recently launched Tines and Vulcan Cyber, to leverage detections and incidents from the Falcon platform, and bring speed, consistency and scale to distributed SOC teams.

New capabilities:

• Accelerate response with customized workflows: Teams can streamline incident response by configuring custom actions and notifications, based on events, triggers and thresholds, resulting in reduced mean time to respond and remediate threat detections.
• Augment your staff by automating the mundane and repetitive tasks: Security teams can automate repetitive manual tasks with consistent workflows, enhance productivity applications to enable faster context and response or automate mitigation actions – ultimately protecting business-critical assets from fast-moving threats.
• Enhance investigation user experience: Analysts can quickly visualize and identify individual detections as being a part of an incident, streamline team assignments and quickly contain all impacted hosts – including those impacted by lateral movement – with a single click.