CrowdStrike Falcon
Endpoint detection and response (EDR) — CrowdStrike
What is this product?
An EDR that watches what happens inside the machines themselves: which process ran, who started it, and what its parent process was — with the option to contain the host and cut it off the network instantly.
About the company
A US company founded in 2011, one of the leading endpoint-protection vendors worldwide, also known for its reporting on threat actors.
What does an analyst do inside it?
- Reads the process tree to find where the attack started.
- Inspects `CommandLine` for suspicious arguments.
- Searches by `SHA256HashData` for the same file on other machines.
- Contains the host when the threat is confirmed, or marks the detection a false positive.
Its search language
These examples are written in the syntax the product itself accepts.
- Hostname: FIN-WS-014
- FileName: powershell.exe
The field names it uses
- Hostname
- UserName
- FileName
- ParentBaseFileName
- CommandLine
- SHA256HashData
- LocalAddressIP4
- RemoteAddressIP4
- EventSimpleName
- PatternDispositionDescription
Practise it now
Pick this product inside the simulator and the field names, search language, severity wording and response actions all switch to match how it works.
Open the simulatorWhere does it show up in the job market?
Frequently required in SOC and incident-response roles; reading its process tree is a skill interviewers ask about.
Tools in the same category
The content is educational and follows the product's style. ShiftZero is not affiliated with the vendor and does not run its software.