Stop cloud breaches with apps built to detect, prevent and respond to threats targeting your workloads, hosts, and containers. 

Discover cloud security apps, integrations, and plugins to upgrade your security stack. Try cloud security solutions from CrowdStrike and our partners here!

Cloud Security Apps, Integrations & Plugins - CrowdStrike Store

Cloud Security

Protect data and users across email and web from unauthorized access, modification, or compromise.

Discover email & web security apps, integrations, and plugins to upgrade your security stack. Try web security solutions from CrowdStrike and our partners here!

Email & Web Security Apps & Integrations - CrowdStrike Store

Email and Web Security

Defend and harden your endpoints including laptops, desktops, servers, and virtual machines, from malicious activity

Discover endpoint security apps, integrations, and plugins to upgrade your security stack. Try endpoint security solutions from CrowdStrike and our partners.

Endpoint Security Apps, Integrations & Plugins - CrowdStrike Store

Endpoint Security

Stop breaches faster by protecting workforce identities and managing their access to applications

Discover identity & access management apps, integrations, & plugins to upgrade your security stack. Try identity & access management solutions here!

Identity & Access Management Apps & Integrations - CrowdStrike Store

Identity and Access Management

Protect your IoT devices from threats by identifying and monitoring risks to ensure consistent availability, integrity, and confidentiality

Discover IOT security apps, integrations, and plugins to upgrade your security stack. Try IOT security solutions from CrowdStrike and our partners here!

IOT Security Apps, Integrations & Plugins - CrowdStrike Store

IOT Security

Improve the efficiency and efficacy of your IT and Security operations with apps that supercharge detection, investigation, and response

Discover IT & SecOps apps, integrations, and plugins to upgrade your security stack. Try IT & SecOps solutions from CrowdStrike and our partners here!

IT & Security Operations Apps & Integrations - CrowdStrike Store

IT and Security Operations

Stop network and infrastructure compromise with apps that protect against unauthorized access, modification, deletion and theft of resources and data

Discover network & infrastructure security apps, integrations, and plugins to upgrade your security stack. Try network & infrastructure security solutions here!

Network & Infrastructure Security Apps & Integrations - CrowdStrike Store

Network and Infrastructure Security

Detect and investigate modern threats with intelligent apps that collect, normalize, and analyze threat behavior for actionable security insights

Discover security analytics apps, integrations, and plugins to upgrade your security stack. Try security analytics solutions from CrowdStrike and our partners.

Security Analytics Apps, Integrations & Plugins - CrowdStrike Store

Security Analytics

Understand a threat actor’s motives, targets and attack behaviors with threat intelligence apps for faster, more informed, data-backed security decisions

Discover threat intelligence apps, integrations, and plugins to upgrade your security stack. Try threat intelligence solutions from CrowdStrike and our partners.

Threat Intelligence Apps, Integrations & Plugins - CrowdStrike Store

Threat Intelligence

80% of all breaches use compromised identities. Protect against identity-based attacks with apps that extend your zero trust strategy. 

Discover zero trust apps, integrations, and plugins to upgrade your security stack. Try zero trust solutions from CrowdStrike and our partners here!

Zero Trust Apps, Integrations & Plugins  - CrowdStrike Store 

Zero Trust

This joint solution provides HDOs with an holistic and accurate picture of all of their connected assets and the risk they pose to their environment so that they can focus on taking appropriate mitigation and remediation steps to reduce this risk.

Medigate Device Security Platform (MDSP)

In today’s threat environment, adversaries focused on industrial control systems (ICS) are commonly known to penetrate industrial organizations via the enterprise IT network and then pivot into the production OT (operational technology) network. By understanding what adversaries are operating in the IT network, you get an early warning about potential threats against your production systems to reduce the risk of disrupted operations. This is accomplished by leveraging Dragos WorldView industrial threat intelligence against your endpoint data collected in your CrowdStrike Falcon platform.

Dragos ICS/OT Threat Detection

Reveal(x) 360 performs full-stream analysis on network traffic from multi-cloud, on-premises and hybrid environments, and then uses cloud-scale machine learning to detect stealthy advanced attack behaviors across the entire network. Reveal(x) 360 pulls endpoint security event data from Threat Graph and correlates that data with observed network behavior and network threat detections in the Reveal(x) 360 console. Data can also be pushed from Reveal(x) 360 to the Falcon platform to trigger automated containment against active network-based threats.
<ul>
 <li>Respond in real time to auto-contain network-based threats, including ransomware, command & control behavior, unauthorized data movement and remote access patterns, data exfiltration, credential abuse, and many others.</li>
 <li>Correlate Reveal(x) 360 detections with Falcon X threat intelligence for fast, seamless IOC investigation.</li>
 <li>Correlate network and endpoint attack details and forensics for full-coverage detection, investigation, and response.</li>
 <li>Discover and identify all devices on the network, and identify those that are not yet instrumented with the CrowdStrike Falcon Agent.</li>
</ul>

ExtraHop Reveal(x) 360

Developed by cybersecurity practitioners, Airlock addresses the technical and organizational challenges typically associated with allowlisting. Airlock delivers purpose-built workflows that enable rapid and scalable deployment while significantly reducing staffing resources required for day-to-day management. Airlock also provides rich file visibility across the organisation, by collecting and building a centralized database of files seen within the environment. This data can be interrogated at anytime and is further enhanced by Crowdstrike Falcon EDR telemetry.

Airlock Allowlisting

Integrating the endpoint coverage you rely on from CrowdStrike with OT visibility and monitoring from Claroty, the joint solution allows you to easily identify, rapidly detect threats to manage all of your IT and OT assets in one place.

Claroty

As attackers’ techniques evolve and user’s ability to do their job from anywhere, on any device increases, security teams must embrace a new approach to security, enabling them to work smarter, not harder. Gone are the days where SOC teams could afford to spend hours trying to understand the scope and severity of an attack. SOC teams need answers fast so they can keep the organization secure. Exabeam, working with CrowdStrike, takes the guesswork out of identifying and mitigating advanced threats.
 
<ul>
<li>Advanced Threat Detection: UEBA uses machine learning to distinguish normal and abnormal behavior, helping to identify risky activity indicating a potential attack even if it has never been seen before. </li>
<li>Lateral Movement Detection: Patented host-to-IP mapping allows Exabeam to automatically attribute endpoint activity back to a user and identify it as anomalous, regardless of how an attacker moves through the network.</li>
<li>Alert Prioritization: Exabeam UEBA aggregates alerts and activity, prioritizes them by risk score, and focuses analysts in the highest risk threats.</li>
<li>Incident Investigation: Exabeam Smart Timelines enable analysts to dramatically reduce time spent on incident investigations by automatically stitching together events before and after an alert to give the full picture of an attack.</li></ul>

Exabeam

SOCs seeking to address blindspots and increase effectiveness have turned to NDR and EDR solutions to acquire the telemetry and detection capabilities necessary to combat adversaries. Gigamon has partnered with CrowdStrike to provide users with a fully unified detection and response solution for active threats. The seamless cloud-to-cloud integration between Gigamon ThreatINSIGHT and the Falcon platform ensures the right data is available at the right time to the right people from within the ThreatINSIGHT console: 
 
<ul>
<li>Falcon X Threat Intelligence is applied against real-time network traffic for immediate detections.</li>
<li>Falcon Insight detections appear alongside ThreatINSIGHT ML and threat intelligence detections for fast adversary identification.</li> 
<li>Falcon Insight endpoint telemetry appears alongside ThreatINSIGHT’s L2 –L7 network telemetry to speed triage, hunting, and investigations. </li></ul>

Gigamon ThreatINSIGHT

Corelight Open Network Detection and Response combines rich network telemetry with world-class endpoint and threat intelligence to eliminate blind spots and detect intrusions across on-premises, multi-cloud, and hybrid environments. Our comprehensive evidence reduces alert fatigue and speeds up investigations.
<ul>
</ul>
Corelight pulls detection rules and indicators of compromise from Falcon X, correlating them with observed network behavior. The resulting Zeek evidence, Suricata alerts, selective packet captures and extracted files can be pushed to SIEMs and log management systems like Humio, as well as analysis tools like Wireshark and Falcon Sandbox.

Corelight Open NDR

Together, Vectra Cognito and Falcon Insight combine cloud and network visibility, with deep endpoint context to create an efficient security operations workflow that reduces response and investigation time, enabling security teams to quickly mitigate high-risk threats from endpoint to cloud.

Vectra Cognito

The Awake Security Platform, the world’s leading advanced network detection and
response platform, integrates fully and easily with CrowdStrike Falcon Insight to
provide the most comprehensive threat detection, rapid and effective response as
well as containment and forensic analysis capabilities. This combination delivers the
visibility and confidence you need to maintain a strong security posture across both
the managed and unmanaged infrastructure within the enterprise.

The Awake Security Platform

Sophisticated attackers are going “beyond malware” to breach organizations, increasingly relying on zero day exploits and hard-to-detect methods such as credential theft, and also tools that are already part of the victim’s environment or operating system. The combination of CrowdStrike Falcon and Aruba ClearPass Policy Manager provides an end-to-end solution that both detects early indicators of potential compromise or infection, along with quick network isolation and zero trust network segmentation to greatly limit any lateral movement.

Aruba ClearPass Policy Manager

The AI-powered ForgeRock Identity Platform is both comprehensive and simple-to-use. It is the only platform that: includes full-suite IAM and identity governance and administration (IGA) capabilities, can be implemented across an organization for all identities (workforce, consumers, things), and offers feature parity across all delivery options, including on-premises, any cloud environment, multi-cloud, hybrid, and as a service. Choose the best authentication method for your users and applications based on endpoint intelligence from CrowdStrike.

ForgeRock Identity Platform

ArcSight Intelligence’s UEBA engine uses unsupervised machine learning and expanded behavioral analytics models on your Falcon data to detect insider threats, critical vulnerabilities, compromised accounts, lateral movement, internal recon, or data exfiltration to reduce dwell time. Utilize the power of unsupervised machine learning to discover the "unique normal" baseline of every user, machine, and entity in your organization. ArcSight Intelligence automatically leverages your organization's baseline to detect hard to find suspicious activity in your organization’s blind spots that may indicate potential threats.

CyberRes ArcSight Intelligence

The Easy NAC solution provides a Zero Trust solution, where devices are restricted at the point of access, and only compliant devices are allowed network access.
 
 
By Integrating with CrowdStrike, Easy NAC solution can automatically learn what devices should be trusted and quarantine untrusted devices. With integration, a CrowdStrike customer would have 100% confidence all their corporate end-user devices are enrolled and the agents are working properly. Devices not enrolled can be restricted until enrolled. Compliance checks can be done that the sensor is up to date, Firewall enabled, and Device Control is enabled.
 
 
In addition to integrating with CrowdStrike, Easy NAC can also check the AD server to learn what devices are joined to the domain, and integrate with patch servers to learn what devices are being managed by the patch server and getting updates.
 
 
Easy NAC also supports Automated Threat Response, and can automatically take quarantine actions on devices reported by CrowdStrike as suspicious.

InfoExpress Easy NAC

Reveal(x) 360 can discover and identify any device that communicates on the network, and eliminate blind spots by delivering to Humio a continuously updated inventory of unmanaged devices and systems that are unable to support an agent. This inventory can include Medical IoT, OT, SCADA devices, and autonomous systems (ASNs) and any other asset that communicates across the network. Reveal(x) also delivers real-time network behavior analysis of unsecured devices, correlated with any other data available in Falcon or Humio products, for complete visibility into challenging environments. Get a deeper understanding of your environment by seamlessly querying ExtraHop’s unique and granular network analysis data within Humio through intuitive dashboards for IOT & Unmanaged Devices, as well as protocols often abused by advanced attackers for lateral movement (AD, MSRPC, Kerberos, and more), providing continuous real-time monitoring.

Reveal(x) 360 + Humio

Reveal(x) 360 can discover and identify any device that communicates on the network and pinpoint whether the Falcon agent is installed on the device by observing network traffic. Customers are then empowered to easily deploy the Falcon agent where it is not present within the network, assuring complete coverage and security detection and response capabilities.

Reveal(x) 360 + Falcon Agent Deployment Coverage

Increase compliance and maximize threat defense by capitalizing on Forescout’s continuous enterprise-wide device visibility and automated workflows integrated with CrowdStrike. 
 
 
The Forescout® eyeExtend for CrowdStrike® module orchestrates information sharing and security workflows between Forescout and CrowdStrike to improve device hygiene, proactively detect threats across the network and automate threat response.
 
 
The integrated solution combines the agentless visibility and control capabilities of the Forescout Platform with the threat intelligence and advanced endpoint protection of the CrowdStrike Falcon® platform.

Forescout eyeExtend

The Darktrace Immune System harnesses scalable, self-learning AI to understand the digital DNA of an organization and illuminate unpredictable cyber-threats at an early stage. By learning the normal ‘patterns of life’ of every person and device in a business, the technology discovers novel attacks and insider threats that other tools miss, while delivering complete visibility. Darktrace integrates seamlessly with CrowdStrike to extend its self-learning AI to the endpoint. By ingesting alerts from CrowdStrike Falcon, Darktrace brings rich, host-level context to bear on AI detections and Cyber AI Analyst investigations across the business.