CrowdStrike Falcon® Adversary OverWatch
Endpoint hunting
Licensed by endpoint/server
Identity hunting
Licensed by active identity**
** Active identities are accounts that have authenticated in the last 90 days
Cloud hunting
Licensed by server/VM/container