CrowdStrike Falcon Complete MDR Reviews

It basically works as an XDR. We have the kind of servers on which our XDR CrowdStrike is installed, and it generates alerts. 

For example, if someone tries to install a systematic agent from their end, it generates an alert. We can then investigate through the incident task and see all the information: the device name, the hostname, and which servers and devices are trying to uninstall the particular product.

It basically works as a security device and provides an extra layer of security to our devices and computers.

Earlier, we used SentinelOne. CrowdStrike has more features than SentinelOne. For example, SentinelOne doesn't have as many features like remediating and showing more information. In CrowdStrike, we can see more information about the incident.

It has a great dashboard and interface, which is very user-friendly. It also provides a detailed analysis of each incident.

It should be integrated with AI and ML. For example, if we face zero-day vulnerabilities on our VCs, integrating them with AI and ML would be great. It's like SOAR, which we use, which automatically remediates everything, eliminating human work. If CrowdStrike also implements this kind of AI and ML feature, it would be beneficial.

I switched my organization to it about three months ago, in April. So, since April I have been using CrowdStike.

I haven't seen any bugs. If I encounter null errors or errors while doing integration or other tasks, I report them. Until now, I haven't seen any bugs.

Since I haven't seen any issues so far, I would give it a ten out of ten.

We have deployed it on every device, so we use it in a large number.

I would rate the scalability a nine out of ten. 

In my previous organization, I used SentinelOne, which is also an XDR. When I switched to a new organization, they were using CrowdStrike.

That's how the switch happened. 

It's cloud-based. I think the cloud is good because deploying on-prem is difficult compared to the cloud. In the cloud, we have better security options, we can log in from anywhere, and we don't have to manage the servers ourselves.

Deployment time: It depends on the number of servers we are using. If we have many servers, it will take some time to install on each device. If the environment is small, it would be a quick installation.

If we need help, we can contact the CrowdStrike Falcon team.

It's quite good. Our organization is very big and has a good budget, but the licensing part is handled by upper-level management.

CrowdStrike has a reasonable price. It's a good price, but if CrowdStrike offered coupons or discounts on a monthly or quarterly basis, it would be more beneficial for smaller vendors trying to implement security. Cutting down some prices would be better so that everyone can use it.

I would recommend CrowdStrike. Even if I were using it and someone asked me which tool to use, I would recommend CrowdStrike.

Overall, I would rate the solution a ten out of ten. 

CrowdStrike Falcon Complete is our EDR solution. It has many modules including vulnerability management, discovery, account application, and assets

Compared to our previous security products, CrowdStrike offers greater efficiency with its various modules that provide full functionality. We've found it to be a helpful tool overall. However, there are some challenges depending on the specific use case and industry, such as finance or retail. This is likely because we're accustomed to our legacy products and CrowdStrike is still new, requiring a learning and testing phase for our team.

We implemented CrowdStrike Falcon Complete to replace the legacy solutions in our environment.

We are impressed with CrowdStrike Falcon Complete SLAs.

The most effective features for detecting and mitigating cyber threats are machine learning and behavior analytics which are well-versed.

CrowdStrike Falcon Complete significantly enhanced our overall security by minimizing false positives, eliminating the need for system restarts during or after deployment.

CrowdStrike Falcon Complete helps us detect and mitigate threats quickly through positive alerts and fast response times.

The management console is user-friendly.

All of the modules are good. The exposure management covers vulnerability management in discovery.  

We find CrowdStrike Falcon Complete to have a steeper learning curve when it is deployed in certain industries such as finance and retail.

I have been using CrowdStrike Falcon Complete for three years.

The technical support is good.

Positive

We were previously using legacy solutions and replaced them with CrowdStrike Falcon Complete because of the next-gen EDR capabilities it offered.

CrowdStrike Falcon offers superior support and technology, making it a better choice than our outdated legacy solutions.

I would rate CrowdStrike Falcon Complete eight out of ten.

CrowdStrike Falcon Complete provides clear and detailed documentation.

I use the solution for a lot of things. It has more visibility than core tech. For example, it's better the TSC scores and that any integration visibility with Zscalar.

The solution helps to provide a better security posture. 

The solution provides more visibility than Zscaler.

There's more security. It provides enhanced security with integration capabilities with third-party tools. 

The threat detection and response are easy. If you have a subscription for the Falcon Consultant Complete sublicense, then they will take care of your MDL service. They will assign their team to it, and they will manage your incident detection and monitoring. CrowdStrike will take care of it via its own expertise so you don't have to overload your existing resources. 

It helps improve our security posture by integrating with web security, email security, and other forms of security. There are also a lot of third-party tools. You have the opportunity for more alerts and security. CrowdStrike shares information with third-party tools that really help with visibility.

The solution is constantly being updated. 

I've been satisfied with the interface. 

We'd like to see the option for an uninstall feature directly on the cloud. It's a tokenless install; however, you should have a token while installing and uninstalling. 

The installation could always be a bit easier. You need to install it manually at the endpoint. 

I've used the solution for a year. 

The stability is very good. I have not witnessed any downtime. 

This is a cloud-based solution, You can easily scale it. 

Technical support has been very good. They are very helpful. It's a strong point for the product.

Positive

I have also used different solutions. For example, I have used Cortex.

The initial setup is very straightforward. It was a simple process.

I'm a technical engineer and don't have visibility on the pricing. However, it can be a bit lower than other options. 

I'd rate the solution 8 out of 10. I can completely rely on CrowdStrike. 

Our customers use it, but we deliver the services. We use it for advanced endpoint protection capabilities and threat-hunting capabilities. We use it for data lakes and repositories to reduce the cost and computational efforts for submitting or uploading in the cloud.

By implementing CrowdStrike Falcon Complete, we wanted to improve the visibility of our operators, analysts, and engineers. We wanted to be more efficient in our operations. Instead of finding information themselves, they can use the platform to find the information automatically.

Its benefits can be seen from the beginning. It is super easy in terms of deployment, and it works perfectly with the human resources and the stack of technologies that our clients have.

Partner support is beneficial. They are a trusted partner. They plan to continue in the market by themselves. They are not expecting somebody to purchase them. It helps to build confidence with the clients, and we can trust that nothing will change in that aspect.

They continue to improve their threat-hunting capabilities, which is important for me because there are more and more advanced threats, such as zero-day attacks. If we combine these threat-hunting capabilities with endpoint detection, we have an extra layer of response. It is super strong for us. We have different agents: one for detection and monitoring and the other one for the preventing aspect, which means threat hunting and response. I can combine the telemetry for threat hunting and monitoring and respond properly.

They are working hard to continue and enhance their labs for identifying new threats and malware. They are continuously labeling them with fancy names for marketing, but they are super helpful and useful because malware and attacks are labeled as per what is happening in specific industries or at specific locations. They give you an overall idea about what is going on not only in your country but also all over the world, and more specifically, in the industry you are working with.

The team of Falcon Complete works around the clock and does monitoring around the clock. It is quite good because it is a solution that combines monitoring and response, and at the same time, it labels all the threats in the world. They are super helpful in managing the threat exposure that companies face on a daily basis. 

The continuous improvement in detections and response times is valuable. They are more focused on threats that come from the cloud, not only that we see. Five or six years ago, we were just focusing on the infrastructure. They, for sure, have better coverage for the supply chain devices or assets that are in the environment of the clients. We have better coverage of third-party vendors, and we have more visibility and more interactions with those third-party vendor solutions.

Some features can be enhanced or improved. For example, there can be more integration capabilities.

There can be an application for the mobile device for the administrator of the platform to have an overview. In less than two minutes, they should be able to see what is going on and take action. Having an overview in a mobile phone would be super helpful for the administrators because everybody has a mobile phone nowadays.

I have been working with CrowdStrike Falcon Complete for four years.

It is stable. It is 90% compliant with what they promised.

It is scalable.

Their support is quite good. I would rate them a seven out of ten. They can add better resources or more resources locally.

Neutral

I am not involved in its deployment, but it can be deployed on-premises and on the cloud. The cloud provider depends on the client's preference. We do not have any issues.

It is expensive, but looking at the capabilities that it brings, it is reasonable.

There are no additional costs to the licensing costs. If you increase the number of licenses, support is included.

I would rate CrowdStrike Falcon Complete an eight out of ten.

We are partners with CrowdStrike and implement CrowdStrike Falcon Complete for all our customers to help protect their environments against breaches and cyber incidents.

Our customers are switching to CrowdStrike Falcon Complete for several reasons. First, their current antivirus solutions are up for renewal. Second, they lack EDR capabilities, which limits their visibility into their security posture. This lack of visibility is a major challenge for them. Finally, they are seeking proactive threat hunting, a service their current Security Operations Center provider doesn't offer. Instead, they receive an unmanaged threat-hunting service, which they find inadequate.

CrowdStrike's Falcon Complete service simplifies endpoint security by using a single sensor we install on our devices. Once installed, CrowdStrike's managed services take care of everything, including monitoring, threat detection, remediation, and alert management. Our customers only need to handle adding new users or groups.

CrowdStrike Falcon Complete improves our ability to respond to and remediate cyber threats.

CrowdStrike Falcon Complete boasts AI-powered analytics that hold significant promise. While I haven't used it personally, we'll be implementing it with a few clients. Once their quarterly reviews are completed, we should gain valuable feedback. The generative AI capabilities seem comprehensive, which is positive for our needs.

The real-time threat-hunting capabilities stand out for us.

Falcon Complete incident response feature works in the background where a team at the threat center reviews the detections and automatically remediates the threats.

We're continually evolving our cybersecurity posture, and Falcon Complete has significantly improved our response time to cyber threats.

We don't have an in-house SOC team so Falcon Complete has been crucial in helping with threat detection and resolution.

Overwatch is the most valuable feature of CrowdStrike Falcon Complete.

Threat hunting is the most valuable feature for strengthening our cybersecurity posture.

I would like to see CrowdStrike Falcon Complete XDR integrate more effectively with other technologies. 

I have been using CrowdStrike Falcon Complete for a few months.

CrowdStrike Falcon Complete is extremely stable.

I would rate the scalability of CrowdStrike Falcon Complete ten out of ten.

The technical support is excellent.

Positive

Before our partnership with CrowdStrike, we offered Trend Micro, McAfee, and Symantec products. We transitioned to CrowdStrike Falcon Complete due to its ideal alignment with our customer needs and its inclusion of threat hunting and cyber insurance within the service package.

The initial deployment is straightforward. We integrated with ADR in SCCM and pushed all the software agents on all the machines. The deployment required two people.

We have seen a return on investment with CrowdStrike Falcon Complete.

I would rate CrowdStrike Falcon Complete ten out of ten.

CrowdStrike Falcon Complete is a managed service so it does not require maintenance from our end.

I recommend CrowdStrike Falcon Complete to others.

Our company uses the solution for our exchange servers, key directory servers, and radio servers.

We currently have three users but may expend in the future depending on strategy and budget.

The endpoint detection and response is very valuable.

The solution should be lighter because it currently uses a lot of computing sources.

I have been using the solution for six months.

The solution is definitely stable so stability is rated a nine out of ten.

The solution is definitely scalable so scalability is rated a ten out of ten.

We contacted technical support once and there was a delay from that SOC center. We haven't contacted support again.

We previously used McAfee but were facing a RAV somewhere in a couple of servers.

The pricing is a little bit expensive for our region.

It is not expensive to get implementation assistance from partners.

Our company is a dealer for Trend Micro so we are more focused on their products.

I can't compare the solution's features to Trend Micro because I can't get them to work in the same environment.

I recommend using the solution. Nowadays, there is a cyber warfare so a bit of protection is important. I rate the solution an eight out of ten.

This is their XDR/MDR service offering. Basically, we used it as our endpoint EDR software. We also leveraged their MDR services to outsource any SOC duties for threat detection and containment. 

We used it in conjunction with LogicHub to have some SOAR capabilities for specific use cases in our environment, which was very useful. It really reduced time for our analysts to do simple detections or things that are triggered for basic automation rules based on a threat instance. 

We used it as a vulnerability dashboard for endpoint management. We deployed the agent in 95% of our endpoints.

It worked much better as an endpoint management tool, like for vulnerability management to track vulnerabilities. It's more about trust and verification rather than relying on the IT Ops team to give us regular reports on the vulnerabilities on the endpoints. 

We relied on the CrowdStrike system to provide evidence to the IT Ops team for patching things that were not really patched. It really worked well for third-party patch management. It's not labeled for that use. However, it worked really well and really helped our patch management initiative with 24/7 coverage for all our endpoints.

We used the quarantine feature as well a few times. We did a trial for it. 

As an end-point solution, nothing beats it, to be honest.

Their threat intelligence is very good. Their MDR response time and the SLAs they have with their MDR SOC team are very good and responsive. Those two have saved us from breaches a few times in my previous role, so it's proven pretty valuable.

The only thing is you have to pay for it, and it's on the expensive side. That's the one thing with any of these services. It also rates highly on the Gartner scale, so obviously, pricing is a bit high.

Their agent is a bit finicky for Mac devices. It works great once you get it working, however, it is a bit finicky to get it deployed across the board. It's not CrowdStrike's fault for the Mac thing, it's just the way Mac is, even though it's not a big concern. 

Their UI is a bit noisy. They have too many sections and they have too many components. It's hard to get all that data into one dashboard, and Falcon Complete has multiple dashboards. It gets a bit cumbersome, that's the only area I would focus maybe a little bit.

Other than that, we didn't really hit any roadblocks, to be honest.

I used it in my previous role for about three and a half years.

The stability is very good. 

Scaling is very easy. We had over 4,000 systems, and we had them installed in AWS servers. Scalability and installation-wise, it is super easy.

Support has been very good.

Positive

I've also used Sophos, those guys are very similar.

Installation is very easy.

Once it's installed, we have a team of four that can handle maintenance duties. SOC operations and IT operations can handle deployment and maintenance tasks. 

IT Ops helps with the installs and they do some of the installs themselves.

I cannot recall the exact pricing of the solution. 

The pricing is fair for what it is. They do provide good service, and the threat intelligence engine is really awesome. I would rate them 4.5 out of five in terms of affordability.

We are just customers and end-users.

What you have to do with any type of endpoint management solution is look at the effort that's required to deploy any solution. I'd recommend new users do a POC for sure in the beginning. And then, based on the POC, always try to negotiate pricing. Definitely do as long as a POC as you can, proof of concept, and see if the solution meets your environment's needs.

I'd rate the solution a nine out of ten.

We wanted a very high level of endpoint protection and intrusion detection. Based on all the reviews, you have a bunch of products out there to choose from. One differentiator of CrowdStrike is that it's nearly what I would call zero-touch on the workstation. You don't have to worry about upgrades and all that. Then, when something suspicious is detected, the CrowdStrike team investigates that for us. It's part of the service that we purchased from them. Basically, we use the solution for security.

Basically, from an overall management perspective of the devices, you really only install the sensor once, and then you set up policies on the portal to say, okay, we want to stay on the N minus one version of the sensor. If there's an update that's required, the portal pushes it to the workstation. It makes everything very easy and doesn't require any touch.

It's mainly the next-generation antivirus that we are leveraging.

In the traditional antivirus, like McAfee, for example, you'd have to maintain signature files and all that on the workstation. We don't have to do that. On top of that, the footprint on the workstation is nearly zero.

One unique thing that they offer is a breach warranty. We basically have a warranty of up to $100,000 should there be any breach that they're not able to manage.

The downside is that if you are using a device offline, not connected to the internet, you will potentially have exposure. Intrusion detection and endpoint protection is all driven using the internet. You have to be connected. If you're not connected, basically, unlike some antivirus software packages, if you introduce something, let's say through a USB port, and you are not online, you have potential exposure.

I'd like to see a capability where the solution can do offline intrusion detection if needed. For example, if you have offline workstations or devices, then there's new data introduced into the device using, I guess, portable data devices. If there was a way to detect that while the device was not connected, that would be great.

It's not a major concern for us since 100% of the time, our devices are connected to the internet because most of our business applications are using cloud-based applications.

The pricing can look expensive.

We started using the solution in April or May of this year. It's only been a few months. 

It's stable. So far, so good. I've not had any issues around it in terms of impacting usage, et cetera. It's pretty transparent to us.

It's pretty scalable. I've talked to some users from huge companies, Fortune 500 companies, so I know that it's scalable.

We don't really have any users for it. It's pretty much myself and one other person who just monitors the portal, and that's about it. In terms of devices, we have 100 to 150 devices. 

We intend to explore the other capabilities of what the sensor can provide us. However, right now, we're just focused on antivirus and intrusion detection. That's about it. 

The intent is obviously to deploy. Every time we have new devices, et cetera, we just deploy this and go.

Support is pretty transparent for me. We've had probably five or six incidents, and they were minor, however, then those are handled by the CrowdStrike team. 

They would notify me if I needed to take action on my side. So far, they are good. I haven't needed to take any drastic action, like shutting down the device and all that.

We had decentralized solutions. They were mainly workstation-based and was McAfee. We went to a centralized solution so that it can be centrally managed.

The setup is pretty straightforward. We started out with a lot of effort since we didn't have managed devices when we installed it. We didn't have a device management system in place for Windows, so we had to install it at each workstation. 

The deployment probably took us a week. We had to install the sensors manually. However, the installation process is very straightforward. It takes less than five minutes.

In terms of maintenance, it's all maintained on the CrowdStrike side.

We did the initial setup ourselves in-house.

There's potentially really no ROI. It addresses an area of risk. That is all. You're putting the investment in the service as a kind of insurance against cyber attacks, data breaches, et cetera.

We have a subscription. 

The cost, the overall cost of the service, is something that could be improved. If you compare it to other antivirus systems, it'll seem more expensive as there's one piece that people overlook - you have a technical team monitoring for you behind the scenes.

The cost is approximately $35,000 to $40,000 a year. It covers up to 300 devices and 300 Windows or Mac OS devices, and about 150 mobile devices. There are no additional costs beyond the main fee. It's all paid on an annual lease. 

We looked at Microsoft Defender, McAfee, Norton, and two other solutions, however, this one came up on top. The only downside is the overall cost when you compare it to the competition.

We are customers and end-users.

I'm not sure which version of the solution we're using. Typically, we set ourselves to N minus one. We're typically one version behind the most current.

I'd warn potential new users that they have to look at the total cost of ownership. One item that's overlooked is when you get an antivirus or a security product, you will need experts to manage and maintain it. CrowdStrike basically provides you with the software solution and the technical support behind it. If you basically add up all those things, it'll probably be on a total cost basis; it'll be reasonable.

I'd rate the solution nine out of ten.