CrowdStrike Falcon FileVantage
File Integrity Monitoring
Falcon FileVantage
Gain central visibility and relevant threat intelligence data efficiently with a streamlined file integrity monitoring solution.
Simultaneously Streamline File Monitoring and Reduce Alert Fatigue
Falcon FileVantage, CrowdStrike's file integrity monitoring (FIM) solution, offers central visibility around changes made to critical configuration, system and content files, as well as critical folders and registries across your entire organization. Security operations teams can use predefined or custom policies and groups to reduce alert fatigue, while broad and detailed dashboards help them keep an eye on all changes regarding these critical files and registries.
In addition to offering central visibility around relevant files and folders, Falcon FileVantage goes beyond compliance requirements by supplying additional context through the CrowdStrike Falcon platform, with detection data to provide more insight to file, folder and registry changes - allowing your organization to improve its security posture.
Falcon FileVantage offers all of these capabilities by leveraging the same lightweight agent used for the Falcon platform.
Key Benefits of Choosing Falcon FileVantage
CENTRAL VISIBILITY
Gain central visibility into all critical file changes with relevant, intuitive dashboards displaying valuable information on what changes, who changed it, and how the files and folders were changed.
ADDED INSIGHT FROM THREAT INTELLIGENCE DATA
FileVantage provides IT staff additional context with added threat intelligence and detection data. Staff can quickly target file change data with any relevant adversary activity.
INCREASE OVERALL EFFICIENCY
Oversee all file changes with summary and detailed view dashboards - reduce alert fatigue by quickly targeting changes to critical files and systems.
Fulfill Compliance Requirements
Falcon FileVantage Enables Organizations to Meet Policy Needs
- Meet PCI, CIS Controls, Sarbanes-Oxley Act and other regulatory bodies to fulfill monitoring requirements.
- See unauthorised modifications to all relevant critical system, configuration and content files.
- Gain instant visibility on all critical folders and registry changes.
- Maintain integrity of critical hosts with continuous, active monitoring.
Reduce Alert Fatigue
- Use pre-defined and custom policies to gain added efficiency and reduce alert volume.
- Create new policies based on all critical files, folders and registries, as well as users and processes.
- Set severities for each policy created.
- Enable or disable policies, and add granular inclusions and exclusions to control false alarms.
Use Detection Data for Added Insights
- Quickly target file, folder and registry changes and see how they relate to active detections.
- Pivot into threat intelligence to learn how asset changes relate to adversary activity.
- Use added detection data to prioritize remediation around affected files.
Key Capabilities
Gain Central Visibility Into All Relevant Files and Folders
Falcon FileVantage offers central visibility into all critical file changes - offering relevant, intuitive dashboards displaying information on registry setting, which files/folders have been created or changed, and who was accessing those files/folders.
In addition, this FIM solution offers real-time visibility for all files and systems relevant to your organization, and allows you to:
- Fulfill compliance requirements: Gain visibility over all relevant files and folders using Falcon FileVantage to support file integrity monitoring regulatory compliance requirements, including the Payment Card Industry Data Security Standard (PCI DSS) and the Sarbanes-Oxley (SOX) Act.
- Gain real-time visibility into file/folder changes: Use real-time monitoring to watch for the creation, modification and deletion of all files and folders relevant to your organization's monitoring process.
- See changes across hosts: Get notified if similar changes have occurred for files/folders across multiple hosts.
- Enhance staff monitoring abilities with intuitive dashboards: See what’s immediately relevant - streamline visibility over large systems throughout your organization with dashboards that show a variety of targeted information, including:
- Systems with the most violations
- Top types of changes being made to files/folders
- Systems by mode in groups
- Change trends - showing alerts from Critical to Low ratings
- Change log views
Use Rich Threat Intelligence Data for Context
Unlike other FIM solutions, Falcon FileVantage* allows even greater visibility and context through added threat intelligence and detection data. FileVantage provides staff the ability to quickly target file change data with any relevant adversary activity. For example, if your organization suffered an attack, IT staff could identify which file/folder changes relate to the attack and pivot from FileVantage directly to CrowdStrike’s Threat Intelligence console. This data allows your teams to move fast, pinpointing the adversary activity within your environments, allowing for quick prioritization of remediation efforts around the affected files.
Reduce Alert Fatigue and Increase Monitoring Efficiency
Security operations staff often have only a limited number of hours each week to review all essential files and system changes. However, when that’s applied at scale, it can become nearly impossible to monitor what’s necessary without alert fatigue.
Falcon FileVantage changes that with real-time monitoring and custom file policies to monitor critical operating system files. With Falcon FileVantage, staff can oversee all file and system changes with both summary and detailed dashboards. This allows staff to seamlessly improve overall security posture while reducing alert fatigue. They can focus on analyzing relevant data in real time. This unique FIM solution increases your team’s efficiency by:
- Utilizing predefined policies and workflows to reduce alert fatigue, cutting down on event volume
- Creating new and customized policies based on your organization’s specific needs
- Setting a severity rating for each policy you establish
- Controlling false alarms with enable/disable functionality
Consolidate Solution: Reduce Costs and Solution Stack
File monitoring should not cost an arm and leg in solution sets, eat into valuable productivity time and create even more work for your team. Falcon FileVantage allows you to simplify your solution stack while reducing operational costs. By integrating this solution, your team can streamline monitoring processes - eliminating redundant tools, improving alert monitoring and gaining valuable data around other detection data to quickly cross-reference changes occurring in your environments.
*Falcon FileVantage requires CrowdStrike Falcon Insight.
Documentation:
Download the CrowdStrike Falcon FileVantage Datasheet (.PDF)