CrowdStrike Falcon

Description

The EDR CrowdStrike Falcon can be deployed within the Virtual Machines of the simulation.

Its agent is available on both Linux and Windows.

CrowdStrike Falcon's alerts and telemetry are sent to the CrowdStrike cloud platform.

The Falcon agent works by using a Customer ID (CID). The CID identifies your CrowdStrike tenant and allows the agent to register against the Falcon platform.

How to enable

You need to provide your Customer ID (CID). You can retrieve it by logging in to the Falcon console, navigating to Host setup and management > Sensor Downloads, and copying the CID displayed at the top of the page.

On the M&NTIS run configuration page, click on "Add" within the CrowdStrike Falcon box, and paste the CID.

Usage

Log in to your Falcon console. Then, navigate to Host setup and management > Hosts to verify that the agents have registered successfully.

To check for alerts triggered by the agents, navigate to the Endpoint detections section under Endpoint Security.

Detections are enriched with MITRE ATT&CK tactic and technique information and include process tree context to assist with investigation.