CrowdStrike + D3 Morpheus
Automated Endpoint Protection and Threat Analysis
A feature-rich integration with the CrowdStrike Falcon platform makes Morpheus the perfect command center for intaking events, detonating malicious files, and orchestrating actions across endpoints.
Expert-Built and Maintained Integrations
Morpheus’s automation-powered playbooks, integrated MITRE ATT&CK framework, and deep investigative capabilities bring effective and repeatable workflows to all endpoint alerts detected by CrowdStrike. D3’s expert knowledge of the CrowdStrike Falcon platform has produced deep integrations that are entirely managed and maintained by our team, so users can simply drop automated actions into their playbooks.
- Orchestrate more than 25 actions in CrowdStrike Falcon from Morpheus
- Automate enrichment of events with threat intelligence from Falcon Intelligence and other sources
- Detonate suspicious files in Falcon Sandbox
Use Case 1
Compromised Endpoint Remediation
When a compromised endpoint is detected, Morpheus enriches the alert with threat intelligence from Falcon X and other sources to get a risk score. If the file is not conclusively known to be malicious, Morpheus then queries the compromised endpoint via Falcon Endpoint Protection to download the file, where it can then be detonated in Falcon Sandbox for analysis. If the file is determined to be malicious, Morpheus can then query other endpoints to find any other instances of the file.
- Identify the full extent of the compromise
- Orchestrate actions across endpoints, such as removing files, blocking hashes, killing processes, or quarantining endpoints
- Unify endpoint investigations with enrichment and response across other tools
Use Case 2
Automated Behavioral Analysis and Remediation
Upon receiving an alert, Morpheus gathers additional context, including user account details and file access patterns, and cross-references this with external threat intelligence to assess threat credibility. High-severity threats trigger immediate endpoint isolation and a deeper investigation using CrowdStrike’s analysis tools. Morpheus then automates remediation actions, such as terminating malicious processes, quarantining affected files, and resetting compromised credentials.
- Correlate against identity information from integrated tools like Active Directory
- Go beyond IOCs to identify serious threats
- Retain important data in Morpheus for 60 days to find patterns over time
Why Morpheus?
Joint users of Microsoft Security tools and D3 Morpheus don’t just get the capabilities we’ve described; they also get the countless other features that make Morpheus the leading autonomous SOC solution, including:
Expert-built AI-ready integrations across the stack
Tier 1–3 automation, based on deep research into the capabilities of common tools
Hyperpipe, which reduces alert volume by up to 98%
Cross-dimension correlation, which acts across tools, timeframes, TTPs, and artifacts
CrowdStrike Integration: Summary
Integrations Done the Right Way
An unlimited number of pre-built integrations, expertly maintained by the largest technical team in security automation. Thoroughly researched, tested and built—and delivered for free. Always.
