CrowdStrike Falcon Insight XDR

What is Falcon Insight XDR?

Falcon Insight XDR is an Extended Detection & Response solution that provides:

• Visibility - full visibility of what’s happening on endpoints
• Detection - real-time threat detection
• Investigation - incident analysis tools
• Response - manual and automated responses

EDR vs XDR:

• EDR (Endpoint Detection & Response) - focus on endpoints
• XDR (Extended Detection & Response) - correlation with cloud, identity, network

Falcon Insight started as EDR, now offers full XDR capabilities.

How does Falcon Insight work?

1. Continuous Recording

Falcon Agent records all events on endpoint:

[Process] --> [File operations]
         --> [Network connections]
         --> [Registry changes]
         --> [Memory access]
         --> [DNS queries]
                |
                v
         [Threat Graph] --> [Analysis] --> [Detection]

Collected data:

• Process creation/termination
• File create/modify/delete
• Network connections (IP, port, protocol)
• Registry operations
• Loaded modules (DLLs)
• User context

2. Real-time Detection

Falcon detects threats in real-time:

Detection sources:

• On-sensor ML - local analysis
• Threat Graph - global correlation
• IOA (Indicators of Attack) - behavioral detection
• IOC (Indicators of Compromise) - known bad
• Custom IOA - custom rules

Example IOA:

IF process.name = "word.exe"
AND child_process.name = "powershell.exe"
AND network.connection = external
THEN alert("Suspicious Office macro")

3. Investigation Tools

Incident analysis tools:

Process Tree:

explorer.exe
  └── outlook.exe
        └── word.exe
              └── powershell.exe [MALICIOUS]
                    └── cmd.exe
                          └── certutil.exe -decode payload.txt

Timeline View:

• Chronological view of all events
• Filtering by type, process, user
• Export for further analysis

Threat Intelligence:

• Automatic IOC enrichment
• Adversary attribution
• Malware family identification

4. Response Actions

Real-time Response (RTR): Remote session on endpoint with full access:

• Process, service listing
• File system access
• Registry access
• Network connections
• Memory dump
• Script execution

Response actions:

• Kill process - terminate malicious process
• Quarantine file - malware isolation
• Network contain - network disconnection (host isolation)
• Delete file - malware removal
• Remediation scripts - automated fixes

XDR - Extended Detection

Falcon Insight XDR correlates data from multiple sources:

CrowdStrike Native

• Endpoints - Falcon Agent
• Cloud - Falcon Cloud Security
• Identity - Falcon Identity Protection
• Mobile - Falcon for Mobile

Third-party Integrations

• Network - Fortinet, Cisco
• Email - Microsoft 365, Google Workspace
• Cloud - AWS, Azure, GCP
• SIEM - Splunk, QRadar, Sentinel

Cross-domain correlation:

[Email: Phishing received] + [Endpoint: Malware executed] + [Identity: Credential stolen]
                                    |
                                    v
                          [Unified Incident View]

MITRE ATT&CK Mapping

Each detection is mapped to MITRE ATT&CK framework:

Example:

Detection: Suspicious PowerShell download
Technique: T1059.001 (PowerShell)
Tactic: Execution
Kill Chain Stage: Installation

This allows for:

• Understanding attacker techniques
• Gap analysis coverage
• Reporting and compliance

Threat Hunting

Falcon Insight offers proactive threat hunting tools:

Falcon Search

Query language for searching data:

process_name:powershell.exe AND cmdline:*-enc*

Scheduled Searches

Saved queries executed cyclically.

Hunting Playbooks

Ready playbooks for searching:

• Credential theft
• Lateral movement
• Data exfiltration
• Persistence mechanisms

Falcon Insight vs Competition

Feature	Falcon Insight	Microsoft Defender	SentinelOne
Architecture	Cloud-native	Hybrid	Cloud/On-prem
Agent size	25MB	200MB+	70MB
XDR scope	Full stack	Microsoft ecosystem	Endpoints + some
Threat intel	CrowdStrike (best-in-class)	Microsoft	Limited
Managed hunting	OverWatch available	Limited	Vigilance available

Implementation with nFlo

1. Planning - scope, policies, integrations
2. Deployment - agent rollout
3. Tuning - custom IOA, exclusions
4. Integration - SIEM, SOAR, ticketing
5. Training - SOC team enablement
6. Operations - ongoing support