CrowdStrike unlocks XDR for all EDR customers and expands third-party integrations across all key security domains

 CrowdStrike (Nasdaq: CRWD), a leader in cloud-delivered protection of endpoints, cloud workloads, identity and data, recently announced that Falcon Insight is now Falcon Insight XDR, enabling all customers to leverage the power of native and hybrid XDR as a fundamental platform capability, with no disruption to existing EDR capabilities or workflows. CrowdStrike is also breaking down the silos that limit the value of native XDR approaches by further integrating third-party telemetry from CrowdXDR Alliance partners, which now include Cisco, ForgeRock and Fortinet as new members, and third-party vendors, which now include Microsoft and Palo Alto Networks. With this release, CrowdStrike is once again disrupting the eXtended Detection and Response (XDR) category. 

CrowdStrike is allowing all EDR customers to easily activate XDR capabilities within Falcon Insight XDR through simple-to-consume connector packs that unlock cross-domain detections, investigations and response actions across all key security domains from a unified console. As a global cybersecurity leader, CrowdStrike is bringing over a decade of experience building an industry-leading EDR to deliver superior cross-domain detection, investigation and response capabilities to stop breaches and deliver an unrivaled experience for security analysts. 

For example, CrowdStrike customers have been leveraging the CrowdStrike Falcon platform – a unified security platform purpose-built with a cloud-native architecture and a single, lightweight agent that powers all products – for XDR use cases for years. CrowdStrike has been enriching endpoint telemetry, which includes threat intelligence and network visibility, with telemetry from cloud workloads (on-premises, in the cloud or in a container), vulnerability management and identity data from other Falcon modules.

“Our XDR strategy has been clear from the beginning: bring the right information into the Falcon platform at the right time. With the introduction of Falcon Insight XDR, CrowdStrike is making it easier than ever for our customers to implement XDR and get EDR-like benefits from native integrations of other Falcon modules from the Falcon platform. And with the introduction of additional third-party integrations, including new CrowdXDR Alliance partners in Cisco, ForgeRock and Fortinet, we are empowering our customers to effectively and elegantly enrich a variety of data sources. By combining first-party and third-party integrations, security teams can create a detailed storyline on how an attack develops and progresses from detection to remediation. That’s the power of XDR and what we are delivering to our customers,” said Michael Sentonas, chief technology officer at CrowdStrike.

CrowdStrike is now: 

Doubling down on third-party integrations: CrowdStrike is committed to supporting leading vendors across all key security domains – email, firewall, identity, NDR and SSE (CASB and web) – to enrich detections, investigations and response actions. Falcon Insight XDR is continuing to add third-party integrations from CrowdXDR Alliance partners, which now include Cisco, ForgeRock and Fortinet as new members, and third-party vendors, which now include Microsoft (for Microsoft 365 and Azure Active Directory) and Palo Alto Networks. 

Deepening first-party integrations: Falcon platform customers who have Falcon Insight XDR and Falcon Cloud Workload Protection, Falcon Identity Threat Protection and/or Falcon for Mobile (EDR) can add the native XDR connector pack, which will be available at cost to ensure all CrowdStrike customers can leverage the platform’s native XDR capabilities. Additionally, CrowdStrike is releasing new expert-developed detections including data from Falcon Identity Threat Protection, as well as integrating additional telemetry from Falcon Horizon (Cloud Security Posture Management) and Falcon Spotlight (Vulnerability Management) into Falcon Insight XDR.

Supercharging the analyst experience with new enhancements for cross-domain investigations: Instantly get the context that matters most by automatically highlighting key findings during investigations, as well as rapidly expand the scope of threat hunting workflows by adding related intelligence to Falcon Insight XDR’s cross-domain graph explorer. These enhancements further speed the ability to drive faster, more accurate detection and response actions.

Extending integrated response with Zscaler: Falcon Insight XDR now integrates with Zscaler Zero Trust Exchange to drive response actions from XDR detections or via automated Falcon Fusion (SOAR) workflows. These automated response actions include limiting or updating user access to applications with adaptive access control policies based on detection criticality, providing full closed-loop remediation across platforms. 

Falcon Insight XDR enhancements are generally available for customers. Third-party and first-party integrations will be generally available by fourth quarter fiscal year 2023. 

ADVT.