What is Falcon OverWatch?
Falcon OverWatch is a human correction detection mechanism that operates as an extension of your team, hunting tirelessly to see and prevent as more sophisticated hidden
BENEFITS
WHY CHOOSE FALCON OVERWATCH
SEE AND STOP HIDDEN ADVANCED ATTACKS
The OverWatch team tirelessly searches for and prevents the most stealthy and sophisticated protections: the 1% of 1% of curves that blend silently and lead to a violation if not first detected.
MAXIMUM EFFECTIVENESS AND EFFICIENCY
OverWatch delivers the best results, expanding analysts' skills and instincts with the most advanced technology. This elite team of experts uses cloud-scale data, custom tools, and minute-by-minute search intelligence to hunt with unprecedented scale.
A CONTINUOUS EXTENSION OF YOUR TEAM
As a central component of the Falcon platform, OverWatch delivers results for associations of all sizes, operating as a continuous extension of your team – minimizing overhead, complexity, and cost.
HOW CROWDSTRIKE DOES IT
PROPRIETARY METHODOLOGY SEARCH OF THREAT HUNTING
The SEARCH Methodology
OverWatch analysts leverage their proprietary SEARCH methodology to illuminate the darkest corners - leaving opponents with nowhere to hide.
SENSE
- Data at cloud scale. The scalable and effective search to correct requires access to large amounts of data and the ability to mine that data in real time for signs of intrusions. CrowdStrike's rich telemetry creates a foundation for a hunt for overwatch limits.
- Trillions of events a week. CrowdStrike's lightweight Falcon sensor delivers continuous telemetry covering hundreds of event types from millions of terminals. All of this is collected and cataloged by the Falcon platform, providing comprehensive visibility into activity across the CrowdStrike installation base.
ENRICH
- Context. The proprietary CrowdStrike Threat Graph contextualizes events and reveals relationships between data points in real time.
- Threat intelligence. CrowdStrike threat intelligence provides up-to-date information on the plot of more than 140 opposing groups, as well as intimate working knowledge of the tactics, techniques and procedures (TTPs) in use in the jungle.
- Proprietary tools. All of this is underpinned by OverWatch's proprietary tools and processes, which ensure that every search is optimized for maximum efficiency.
PARSE
- Human analysis. Threat hunting involves obtaining enriched data and applying complex statistical methods, examining outliers and frequency analysis. It involves using intuition and experience to form and test hypotheses about where and how a particular attacker can hide their operations.
- More than 200 years of diverse experience combined. OverWatch employs elite experts from a wide variety of backgrounds, including government, law enforcement, business, intelligence and defense.
- Continuous surveillance 24/7/365. When a sophisticated intrusion occurs, time is critical. Your opponents don't sleep and are not restricted by time zones or geography - nor are your threat hunting team.
RECONSTRUCT
- Connect the dots. Before you can act against an opponent, you first need to fully understand the threat. As soon as a keyboard invasion is discovered, OverWatch begins to rebuild the attack comprehensively.
- Ask the right questions. The experience helps OverWatch quickly focus on how the attacker gained access and how far the invasion spread.
- Get answers in seconds. CrowdStrike's proprietary threat chart provides OverWatch analysts with answers to these questions in near real time.
- Set up the full story in minutes. Falcon's Incident Workbench provides the ideal structure for assembling the puzzle.
COMMUNICATE
- A team, a fight. CrowdStrike pioneered the idea of creating a perfect union between technology, experts and its team, closing the gap between detection and response.
- Frictionless communication. OverWatch operates as a native component of the Falcon platform and a force multiplier for your team, providing timely threat information on your only native cloud console.
- Actionable insights. You get results, including deep-context alerts and response-driven recommendations, starting on the first day without any new infrastructure, communication channels, or processes.
MEL
- Improvement continues. Threat hunting is not a one-off activity; is a process that requires continuous improvement and improvement of your tools to deal with evolving opposing TTPs.
- Always sharp. OverWatch's continuous and proactive operation delivers results every minute, every day. Each threat they deal with allows OverWatch hunters to continually adjust their skills and processes, ensuring they are always alert, effective, and ready for the next new threat.
System requirements:
CPU: 1.8 GHz dual core processor
RAM: 2 GB
HDD / SSD: 50 GB of free space on the main drive
Operating system: Microsoft Windows 10, Microsoft Windows 8 32-bit, Microsoft Windows 7 32-bit and Microsoft Windows Vista 32-bit
Resolution: 1024×768
Supported operating systems
Mac OS X 10.5 x (Leopard), Mac OS X 10.6 (Snow Leopard), Mac OS X 10.7 (Lion), Mac OS X 10.7 (Mountain Lion), OS X 10.9 (Mavericks) and Mac OS X 10.10 (Yosemite)
Hardware requirements
Memory - 1 GB of RAM and more
Free disk space - 50 MB
System type - 32-bit and 64-bit OS
