CrowdStrike Alliance

DISRUPT FUTURE ATTACKS WITH NETWORK EVIDENCE

Increase detection coverage, accelerate response, and expand visibility across your network with Corelight and CrowdStrike. Corelight’s Open NDR Platform delivers evidence, insights, and indicators to the AI-native CrowdStrike Falcon^® platform to find and disrupt adversaries.

Corelight pre-correlates its logs and detections with endpoint and relevant vulnerability data from CrowdStrike Falcon directly at the sensor, so organizations can better understand and prioritize the most vulnerable endpoints across the enterprise. Going one step further, this unique integration enables fast and easy isolation of those endpoints that show signs of compromise, such that when Corelight detects a compromise, analysts can use Corelight Investigator to quickly assess the threat and isolate devices with a single click.

WATCH VIDEO

Integration benefits:

Detect network threats in real-time at the point of observation
Close visibility gaps and validate network inventory
Reduce MTTR with Falcon-enriched network evidence
Expose hidden attacks with rich, lightweight telemetry
Improve operational efficiency and reduce complexity

FALCON NEXT-GEN SIEM

Reduce dwell time with out-of-the-box dashboards, correlation rules, and real-time Falcon data enrichment.

JOINT SOLUTION BRIEF

FALCON LOGSCALE

Corelight + Falcon LogScale allows you to store and search network metadata on-prem for a fraction of the cost of full packet capture.

FALCON EXPOSURE MANAGEMENT

Risk-based alert triage helps resource-constrained security teams prioritize exploits against known vulnerable hosts.

FALCON INTELLIGENCE

Expand Falcon detection coverage to the network by operationalizing your cyber threat intelligence. Corelight leverages CrowdStrike Falcon Intelligence® Premium rules that can only be implemented on the network to help orchestrate your defenses.

FALCON SANDBOX

Corelight's high-speed file extraction capability turns raw packets into extracted and deduplicated files for malware analysis in CrowdStrke Falcon^® Sandbox.

WATCH VIDEO

CROWDSTRIKE SERVICES

CrowdStrike consultants’ skills and experience, combined with Corelight's multifaceted detection capabilities, allow organizations to respond to and contain incidents faster and more efficiently.

Fast and easy deployment with out-of the-box workflows

Out-of-the-box data, queries, and dashboards simplify Next-Gen SIEM adoption and accelerate investigations from within the Falcon platform.

Intuitive at-a-glance views of an organization's security posture provide visual insights into potential threats using real-time network telemetry. With summary charts, counters, and maps, SOC analysts can quickly identify trouble spots and drill down into details to validate threats. This clarity and guidance provides focus where it's most needed, ultimately accelerating investigations and response times while streamlining workflows.