CrowdStrike Falcon Forensics
Streamlining triage data collection and analysis

Triage Large-scale Investigations Quickly In A Single Solution

Falcon Forensics is CrowdStrike’s powerful forensic data collection solution. It allows threat hunters and responders to speed up investigations and conduct periodic compromise assessments, threat hunting and monitoring.

With CrowdStrike® Falcon Forensics, responders are able to streamline the collection of point-in-time and historic forensic triage data for robust analysis of cybersecurity incidents. Responders gain the ability to research and investigate incidents faster and with greater precision. Falcon Forensics leverages a dissolvable executable and the CrowdStrike cloud, which leaves a minimal trace on endpoints. Streamlined management via the Falcon Forensics console and dashboards makes triage fast and easy

Key Benefits of Choosing Falcon Forensics

the single solution for collecting and analyzing detailed forensic data

SIMPLIFY FORENSIC DATA COLLECTION AND ANALYSIS

Falcon Forensics offers comprehensive data collection while performing triage analysis during an investigation. Forensic security often entails lengthy searches with numerous tools. Simplify your collection and analysis to one solution to speed triage.

SPEED RESPONSE TIME AND HONE IN ON ATTACKER ACTIVITY.

Falcon Forensics automates data collection and provides detailed information around an incident. Responders can tap into full threat context without lengthy queries or full disk image collections.

ACCELERATE TRIAGE ANALYSIS WITH PRESET DASHBOARDS.

Incident responders can respond faster to investigations, conduct compromise assessments along with threat hunting and monitoring with Falcon Forensics. Pre-built dashboards, easy search, and view data capabilities empower analysts to search vast amounts of data, including historical artifacts, quickly.

Key Capabilities

Falcon Forensics is a robust solution that simplifies forensic data analysis by eliminating the need for multiple tools or data ingestion methods. Analysts can quickly gather and analyze large quantities of historical data to triage incidents and accelerate compromise assessments.

Improve Efficacy and Time-To-Respond

Zero in on attacker activity with preset dashboards. Live and historical deep-level triage data served up in preset dashboards eliminates lengthy research time to respond to incidents, speeding analysis and triage. Responders can target attacker activity with convenient filters, queries and dashboards to quickly gain essential insights. Dashboard capabilities include:

• Deployment status: Gain visibility over collections and trends for the past 24 hours across your enterprise.


• High-level telemetry view of a single system: See contextual information about an attacker's activity outside a single query, with pictorial histograms within a given timeframe.


• Quick Wins displaying high signal-tonoise ratios: Quickly identify potential misconfigurations and hacker activity with preset panel groupings. Customize the dashboard by selecting groupings relevant to your analysis.


• Timeline format for a single system: Gather and analyze multiple artifacts for a single system and timeframe. Use this host timeline dashboard to get a visual representation of artifacts for a specific timeline of events.

Reduce Workflow Complexity

Harness the power of CrowdStrike Real Time Response and Falcon Forensics with their simple, large-scale deployment ability. Easy to deploy, Falcon Forensics can get you up and running in a minimal amount of time, from a single workstation to tens of thousands of endpoints.

• Operate with a single solution and eliminate time-consuming efforts to collect and consolidate forensics data.


• Deploy Falcon Forensics via CrowdStrike's Real Time Response for quick and easy deployment.


• Leverage the cloud for data processing, freeing up systems to continue business-critical functions.


• Gather collected data from ten to hundreds of thousands of endpoints with large-scale deployment capability.


• Avoid ongoing maintenance and management. The Falcon Forensics dissolvable agent performs the collection of artifacts and then removes itself from the system, leaving minimal trace. It does not persistently remain as yet another agent to maintain and manage on systems.

Simplify Data Collection And Research

Falcon Forensics provides the ability to automate data collection while also providing a convenient console that gives responders detailed information about an incident.

• Tap into full threat context without lengthy queries or full disk image collections.


• Uncover attacker activity that may have occurred before Falcon endpoint detection and response (EDR) monitoring.


• Take advantage of advanced query capabilities for in-depth research. In addition to preset and packaged dashboards, Falcon Forensics makes the raw event data available so responders can customize their queries.


• Track attacker activity by analyzing the Master File Table (MFT), shim cache, shellbags and other artifacts within your organization.


• Gain critical contextual data on threats and specific threat actors by combining historical forensics data with CrowdStrike's advanced threat intelligence - giving a holistic picture of specific attack methods and techniques an attacker might use.