CrowdStrike Falcon Endpoint Protection

When a compromised endpoint is detected, Smart SOAR enriches the alert with threat intelligence from Falcon X and other sources to get a risk score. If the file is not conclusively known to be malicious, Smart SOAR then queries the compromised endpoint via Falcon Endpoint Protection to download the file, where it can then be detonated in Falcon Sandbox for analysis. If the file is determined to be malicious, Smart SOAR can then query other endpoints to find any other instances of the file. Having now identified the full extent of the compromise, the analyst can use Smart SOAR to orchestrate actions across the affected endpoints, such as to remove the file, block the hash, kill processes, or quarantine the endpoint.

Upon receiving an alert, Smart SOAR gathers additional context, including user account details and file access patterns, and cross-references this with external threat intelligence to assess threat credibility. High-severity threats trigger immediate endpoint isolation and a deeper investigation using CrowdStrike's analysis tools. Smart SOAR then automates remediation actions, such as terminating malicious processes, quarantining affected files, and resetting compromised credentials.