CrowdStrike Falcon OverWatch

What is Falcon OverWatch?

Falcon OverWatch is a 24/7 managed threat hunting service - elite CrowdStrike analysts proactively search your environment for threats that may have bypassed automated detection systems.

Why you need threat hunting:

• Advanced attackers evade automated detection
• Dwell time (time from breach to detection) averages 197 days
• Hunters look for subtle signals that ML may miss
• Your team doesn’t have 24/7 capacity

How does OverWatch work?

Operating Model

[Your Endpoints] --> [Falcon Agent] --> [CrowdStrike Cloud]
                                              |
                                    [OverWatch Team] 24/7
                                              |
                          [Hunting] --> [Detection] --> [Notification]
                                                              |
                                                        [Your SOC]

Hunting Process

1. Data Analysis OverWatch has access to telemetry from your Falcon:

• Process execution
• Network connections
• File operations
• Registry changes
• Memory events

2. Threat Hunting Analysts use combination of:

• Hypothesis-driven hunting - “What if attacker is already inside?”
• Intel-driven hunting - New TTPs from threat intelligence
• Behavioral hunting - Anomalies in normal patterns
• Custom hunting - Specific to your industry

3. Investigation When they find something:

• Full scope analysis
• TTP identification
• MITRE ATT&CK mapping
• Impact assessment

4. Notification 1-minute notification SLA:

• Critical threats - immediately
• Detailed description of what was found
• Response recommendations
• Optionally: remote response

What does OverWatch detect?

Hands-on-Keyboard Activity

Attacker manually in environment:

• Interactive shell sessions
• Lateral movement
• Credential harvesting
• Data staging for exfiltration

Living-off-the-Land

Using legitimate tools:

• PowerShell abuse
• WMI persistence
• Scheduled tasks
• Registry run keys

Novel Techniques

New methods unknown to signatures:

• Custom malware
• 0-day exploits
• New evasion techniques
• Targeted attacks

Supply Chain Attacks

Attacks through trusted software:

• Compromised updates
• Trusted vendor abuse
• Software supply chain

OverWatch Elite vs Standard

OverWatch (Standard)

• 24/7 threat hunting
• 1-minute notification
• Quarterly threat briefings
• Access to threat reports

OverWatch Elite

Everything from Standard plus:

• Assigned analyst - dedicated analyst knowing your environment
• Weekly calls - regular meetings
• Custom hunting - hunting for your specific risks
• Priority response - priority incident handling
• Annual threat assessment - yearly threat assessment

OverWatch Statistics

From CrowdStrike 2024 report:

• 80,000+ hands-on-keyboard intrusions stopped
• 1 minute average time to notification
• 24/7/365 coverage without breaks
• 230+ elite analysts globally

Workflow with Your SOC

Notification

OverWatch detects --> Notification to your SOC
                           |
                    [Email + Dashboard alert]
                           |
                    Details:
                    - What was found
                    - Affected hosts
                    - MITRE ATT&CK mapping
                    - Recommended actions

Response Options

1. Self-service response Your SOC uses Falcon Real-Time Response.

2. Guided response OverWatch guides through response.

3. Managed response OverWatch executes response for you (Elite).

Why OverWatch?

Expertise

• 230+ analysts with IR experience
• Access to CrowdStrike threat intelligence
• See attacks from around the world

Coverage

• 24/7/365 without breaks
• Vacations, weekends, holidays
• Shift coverage across time zones

Speed

• 1-minute notification SLA
• Faster response = less damage

Cost

• Cheaper than own 24/7 threat hunting team
• Access to world-class expertise

Integration with Your SOC

OverWatch doesn’t replace your SOC - extends its capabilities:

Your SOC	OverWatch
Alert triage	Proactive hunting
Incident response	Early detection
Daily operations	24/7 coverage
Internal threats	External expertise

Implementation

Requirements:

• Falcon Insight XDR (agent must be deployed)
• Network connectivity to CrowdStrike cloud

Onboarding:

1. Kick-off call - environment understanding
2. Environment profiling - what is “normal”
3. Contact setup - who receives notifications
4. Hunting begins - protection from day 1

Implementation time: 1-2 weeks