CrowdStrike Expands Falcon Data Replicator Capabilities to Boost SOC Performance

Are you getting the most from your data? Collecting data from across your environment can provide security teams with the visibility needed to detect and respond to threats, but large volumes of data and alerts can be overwhelming and cause excessive noise. And, not all data is useful data — some details or feeds may be irrelevant for your teams, causing unnecessary complexity and bogging down infrastructure.

To optimize data for effective threat detection and response, security teams need more control to get the right contextual data, in the right location, at the right time, given their unique needs.

CrowdStrike Falcon^® Data Replicator (FDR) provides your team with the right data and actionable insights to improve SOC performance by forwarding enriched, near real-time events collected from the CrowdStrike Falcon^® platform to the third-party storage or log management platform of your choice. To boost operational efficiency, CrowdStrike has introduced powerful new FDR customization features to make data management easier and data processing more cost-effective. These capabilities will empower your team to tailor FDR data to your unique business needs.

With FDR, you can now:

• Reduce data volumes with filtering to cut cost: FDR filtering allows you to select which sensor events to include in your FDR feeds, reducing the amount of data your team stores and processes while ensuring you get the information you need. You can easily enable up to four FDR feeds with one filter per feed in order to home in on the most important events to your business. Filtering reduces data volumes, complexity and costs while improving threat detection and response.
• Split data into ranges to find answers faster: Your team can now split FDR data by time or operating system (OS) to optimize data processing downstream. Partitioning by time or platform makes it faster to locate relevant time-based or platform-based data, speeding up incident response, forensic investigations and compliance. Quickly surface needed data within your third-party tools based on a specific date, time or OS criteria to accelerate SOC performance — like quickly looking up activity for a given time period related to a suspected threat actor in your organization, or sweeping for the presence of an indicator of compromise (IOC) across a certain OS.
• Get event insights on demand with new data schema API: With the new data schema API, you can easily query Falcon data on demand to get meaningful information surrounding FDR sensor event schemas for advanced processing and internal application. The FDR data schema API empowers your team to get the sensor event information they need at any time, saving time and improving operations.

The industry-leading CrowdStrike Falcon platform sets the new standard in cybersecurity. Watch this demo to see the Falcon platform in action.

Optimize Performance with FDR Data

Diving deeper, Falcon Data Replicator collects near real-time events from across your endpoints, cloud workloads, identities and data that can be leveraged within the Falcon platform or forwarded to your existing third-party security tools, like your SIEM, giving your team the contextual visibility needed to meet compliance use cases and enable effective threat detection and response. For organizations that want to analyze and retain their security data longer for threat hunting, CrowdStrike Falcon® Long Term Repository provides cost-effective long-term retention, high-speed search and visualization of Falcon security data to extend visibility for improved detection and response to slow-moving, elusive attacks.

Boost Your Team’s Output with Actionable Insights

With FDR, your team can get the best data from across your environment to improve your security team’s visibility of the attack surface and potential threats. The new FDR customization capabilities enable you to easily filter out unneeded data to free up storage and processing, partition data to quickly locate relevant details in an incident or investigation, and get needed sensor event information on demand. With enriched and customizable data from the Falcon platform, your team will have the best data, tailored to your unique needs, to ensure cost-effective protection and end-to-end threat coverage.

If you’re not yet a CrowdStrike customer, request a free trial.

Additional Resources

• Get technical details about Falcon Data Replicator in the data sheet.
• Learn how the powerful CrowdStrike Falcon platform provides comprehensive protection across your organization, workers and data, wherever they are located.
• See for yourself how the industry-leading CrowdStrike Falcon platform protects against modern threats. Start your 15-day free trial today.