CrowdStrike POC Command Center

Falcon EDR/XDR Platform — Proof of Concept Toolkit

25+

IOA Rules

Policies

MITRE Tactics

Active

POC Status

POC Checklist

Track your deployment progress

0 / 7 completed

Falcon Sensor Installed

Prevention Policy Configured

IOA Rules Created

IOC Integrated

Detection Test Done

Prevention Test Done

Report Generated

Quick Actions

POC Deployment Guide

Complete step-by-step guide for deploying and demonstrating CrowdStrike Falcon to enterprise clients.

What is CrowdStrike Falcon?

CrowdStrike Falcon is a cloud-native endpoint protection platform combining EDR (Endpoint Detection & Response) and XDR (Extended Detection & Response) capabilities. Unlike legacy AV, it uses a single lightweight agent (sensor) that streams telemetry to the Falcon cloud for real-time analysis.

Falcon Prevent

Next-Gen Antivirus — ML-based prevention, exploit blocking, ransomware protection

Falcon Insight

EDR — Full endpoint visibility, threat hunting, incident investigation

Falcon OverWatch

Managed Threat Hunting — 24/7 expert threat hunters augmenting your SOC

How the Sensor Works: The Falcon sensor is a kernel-level agent (~25MB) that hooks into OS internals to monitor process creation, file writes, network connections, and registry changes. All telemetry streams to the CrowdStrike Threat Graph for cloud-based behavioral analysis. Detections happen in <1 second — no signature updates required.

Sensor Installation

Download the sensor from Host Setup > Sensor Downloads in the Falcon console. Each installer requires your unique Customer ID (CID).

Windows Installation (Admin PowerShell)

# Download sensor from Falcon Console > Host Setup > Sensor Downloads
.\WindowsSensor.exe /install /quiet /norestart CID=<YOUR_CID>

# Verify sensor is running
sc query csagent
Get-Service CSFalconService

Linux Installation (Root)

# RPM-based (RHEL, CentOS, Amazon Linux)
sudo yum install falcon-sensor-*.rpm
sudo /opt/CrowdStrike/falconctl -s -f --cid=<YOUR_CID>
sudo systemctl start falcon-sensor

# DEB-based (Ubuntu, Debian)
sudo dpkg -i falcon-sensor_*.deb
sudo /opt/CrowdStrike/falconctl -s -f --cid=<YOUR_CID>
sudo systemctl start falcon-sensor

# Verify
sudo systemctl status falcon-sensor
ps aux | grep falcon

macOS Installation

# Install PKG from Falcon Console
sudo installer -pkg FalconSensorMacOS.pkg -target /
sudo /Applications/Falcon.app/Contents/Resources/falconctl license <YOUR_CID>

# Verify
sudo /Applications/Falcon.app/Contents/Resources/falconctl stats

Prevention Policy Configuration

Navigate to Configuration > Prevention Policies. Create a new policy or modify the default. Enable the following for the POC:

Must Enable:

☑ Cloud Machine Learning — Aggressive
☑ Sensor Machine Learning — Aggressive
☑ Exploit Protection — All categories
☑ Ransomware Protection — Enabled
☑ Script-Based Execution Monitoring
☑ Suspicious Process Blocking
☑ Sensor Anti-Tampering

Show Client During Demo:

→ Policy applied in real-time, no reboot
→ Granular control per host group
→ Detection vs Prevention slider
→ Exclusion paths for LOB apps
→ Policy precedence and inheritance
→ Update rings for sensor versions

Detection Testing

Test detection capabilities using safe, controlled methods:

EICAR Test File (Safe malware test string)

# PowerShell — download EICAR test file
Invoke-WebRequest -Uri "https://secure.eicar.org/eicar.com.txt" -OutFile "C:\temp\eicar.com"

# What to show client:
# 1. Detection appears in Activity > Detections within seconds
# 2. Process tree shows full execution chain
# 3. Severity classification and MITRE mapping automatic

Behavioral Detection Test

# Simulate suspicious PowerShell behavior (safe)
powershell.exe -NoProfile -Command "[System.Net.WebClient]::new()"

# Simulate credential access pattern
rundll32.exe keymgr.dll, KRShowKeyMgr

# These trigger behavioral IOAs without actual malicious activity

Expected alerts: Falcon will generate detections showing process tree, command line arguments, parent process, network connections, and file modifications. Walk the client through the detection detail view — this is where Falcon's value is most visible.

Prevention Demonstration

With Prevention Policy active, demonstrate real-time blocking. Show the client the Falcon Console at Activity > Detections, filtering by Prevention action type. Key console navigation:

▸ Endpoint Detections — Activity > Detections (filter: Action = Prevented)
▸ Process Explorer — Click any detection > Execution Details > Full process tree
▸ Host Timeline — Investigate > Host Search > Select host > Timeline
▸ Real Time Response — Host > Actions > Connect (RTR shell)

Tip: Open the console on a projector during live testing so the client sees the detection appear in real-time.

Client Presentation & ROI

Key Talking Points:

▸ Single lightweight agent — no performance impact
▸ Cloud-native — no on-prem infrastructure
▸ Sub-second detection — Threat Graph AI
▸ 24/7 managed hunting with OverWatch
▸ Integrated threat intelligence
▸ 15+ modules from one agent

ROI Arguments:

▸ Avg breach cost: $4.45M (IBM 2023)
▸ MTTD reduced from 207 days to minutes
▸ Consolidation: replace 5-8 point products
▸ 97% detection rate in MITRE evaluations
▸ FedRAMP authorized — gov ready
▸ Leader in Gartner MQ 10+ years

Reports: Export from Falcon > Reports. Key reports: Executive Summary, Threat Landscape, Detection & Prevention Summary. Use the Report tab in this tool to generate a custom POC report.

IOA Custom Rules

Indicator of Attack rules for behavioral detection. These rules trigger on adversary tradecraft patterns, not just static signatures.

Indicators of Compromise

IOC management, integration steps, and free threat intelligence sources for your Falcon deployment.

IOA vs IOC — What's the Difference?

IOA — Indicator of Attack

Behavioral patterns that indicate an active attack is happening. IOAs detect the technique regardless of the specific tool used. Example: Any process accessing LSASS memory is suspicious, not just Mimikatz specifically. IOAs catch zero-days and novel attacks because they focus on behavior, not signatures.

IOC — Indicator of Compromise

Static artifacts that indicate a compromise has occurred. IOCs are reactive — they identify known-bad indicators like file hashes, malicious IPs, or C2 domains. Essential for blocking known threats and hunting for past compromises. Require continuous updates from threat intel feeds.

IOC Types & Examples

Type	Description	Example
SHA256 Hash	File hash — uniquely identifies malicious file	e99a18c428cb38d5f260853678922e03abd8344fcba34ab7bc78...
MD5 Hash	Legacy hash format — still widely used in feeds	44d88612fea8a8f36de82e1278abb02f
IP Address	Malicious C2 server or infrastructure IP	185.220.101.42
Domain	C2 domain, phishing, or malware distribution	evil-update.malwaredomain.com
URL	Specific malicious URL path	hxxp://evil.com/payload/stage2.exe
Registry Key	Persistence or config modification indicator	HKLM\Software\Microsoft\Windows\CurrentVersion\Run\malware
File Path	Known malware drop locations	C:\Users\Public\Documents\svchost.exe
Email Address	Phishing sender or attacker email	admin@fake-microsoft-alert.com

IOC Integration Steps in Falcon

Navigate to Threat Intelligence > Indicators

From the Falcon console sidebar, expand Threat Intelligence and click on Custom Indicators

Click "Add Indicator" or "Upload CSV"

Single indicators can be added manually. For bulk import, use the CSV upload feature

Select Indicator Type and Enter Value

Choose: SHA256, MD5, Domain, IPv4, IPv6. Enter the indicator value

Set Action: Detect, Detect & Prevent, or No Action

Detect = alert only. Detect & Prevent = block execution/connection. No Action = monitor silently

Configure Severity and Expiration

Set severity (Critical/High/Medium/Low) and optional expiration date for time-sensitive IOCs

Apply to Host Groups and Save

Assign the IOC to specific host groups or apply globally. IOC is active immediately

Sample IOC CSV

ioc_import.csv

type,value,action,severity,description,tags,expiration
sha256,e99a18c428cb38d5f260853678922e03abd834f0a2b4c59166c22a0ce145b853,prevent,critical,Ransomware payload - LockBit,ransomware;lockbit,2026-06-30
domain,evil-update.malwaredomain.com,prevent,high,C2 domain - Cobalt Strike,c2;cobaltstrike,2026-06-30
ipv4,185.220.101.42,detect,high,Known C2 infrastructure,c2;apt,2026-04-30
sha256,44d88612fea8a8f36de82e1278abb02f72a7bed46cbc52a2f72a7bed46cbc52a,prevent,critical,Mimikatz variant,credential-theft;mimikatz,2026-12-31
domain,phishing-login.microsoft-verify.com,prevent,high,Phishing domain,phishing;credential-harvest,2026-05-15
ipv4,91.215.85.100,detect,medium,Suspicious scanning IP,scanning;recon,2026-04-15

Free IOC Intelligence Sources

AlienVault OTX

Open Threat Exchange — Community-driven threat intel with pulse subscriptions

otx.alienvault.com

VirusTotal

Multi-engine file/URL scanning and threat graph analysis

virustotal.com

Abuse.ch

MalwareBazaar, URLhaus, ThreatFox — free malware & IOC feeds

abuse.ch

MISP

Open source threat intelligence platform with automated sharing

misp-project.org

OpenCTI

Open cyber threat intelligence platform with STIX2 support

opencti.io

Policy Configuration

Configure prevention, detection, and response policies for the POC environment. Toggle switches to visualize recommended settings.

Prevention Policy

Core endpoint protection — all recommended ON for POC

Detection Policy

Visibility and detection capabilities

Response Policy

Incident response and containment capabilities

SIEM & SOAR Integration

Step-by-step integration guides for connecting CrowdStrike Falcon to your security stack.

Splunk Integration

Splunk + CrowdStrike Setup

# Step 1: Install CrowdStrike App for Splunk
# Download from Splunkbase: "CrowdStrike Falcon Event Streams"
# Install via Splunk Web > Manage Apps > Install from File

# Step 2: Configure HEC (HTTP Event Collector) Token
# Settings > Data Inputs > HTTP Event Collector > New Token
Token Name: crowdstrike-falcon
Source Type: crowdstrike:events
Index:        crowdstrike

# Step 3: Configure Event Streaming API in Falcon
# Falcon Console > Support > API Clients > Add New Client
# Scopes: Event Streams (Read), Detections (Read), Incidents (Read)

# Step 4: Configure Falcon SIEM Connector
./falcon_siem_connector \
  --client-id <API_CLIENT_ID> \
  --client-secret <API_SECRET> \
  --base-url https://api.crowdstrike.com \
  --output splunk \
  --hec-url https://splunk-hec:8088 \
  --hec-token <HEC_TOKEN>

# Step 5: Verify data in Splunk
index=crowdstrike sourcetype=crowdstrike:events | stats count by event_simpleName

# Step 6: Import pre-built dashboards from CrowdStrike App

Microsoft Sentinel Integration

Sentinel + CrowdStrike Setup

# Step 1: Navigate to Microsoft Sentinel > Data Connectors
# Search for "CrowdStrike Falcon" connector

# Step 2: Create API credentials in Falcon Console
# Support > API Clients > Add New Client
Scopes Required:
  - Event Streams (Read)
  - Detections (Read)
  - Incidents (Read)
  - Hosts (Read)

# Step 3: Configure the Sentinel connector
Client ID:     <FALCON_CLIENT_ID>
Client Secret: <FALCON_CLIENT_SECRET>
Base URL:      https://api.crowdstrike.com

# Step 4: Log types ingested
CrowdStrikeFalconEventStream_CL  // Event stream data
CrowdStrike_Detection_CL         // Detection events
CrowdStrike_Incident_CL          // Incident data

# Step 5: Verify in Log Analytics
CrowdStrikeFalconEventStream_CL
| summarize count() by EventType_s
| sort by count_ desc

Elastic SIEM Integration

Elastic + CrowdStrike Setup

# Step 1: Add CrowdStrike module via Fleet
# Kibana > Fleet > Agent Policies > Add Integration > CrowdStrike

# Step 2: Configure SIEM Connector
Client ID:        <FALCON_CLIENT_ID>
Client Secret:    <FALCON_CLIENT_SECRET>
API URL:          https://api.crowdstrike.com

# Step 3: Configure Elasticsearch endpoint
ES Host:          https://elasticsearch:9200
Index Pattern:    logs-crowdstrike.*

# Step 4: Enable CrowdStrike detection rules
# Security > Rules > Load Elastic prebuilt rules
# Filter by "CrowdStrike" integration tag
# Enable all detection and prevention rules

# Step 5: Verify data flow
# Discover > Index pattern: logs-crowdstrike.*

IBM QRadar Integration

QRadar + CrowdStrike Setup

# Step 1: Install CrowdStrike DSM
# Admin > DSM Editor > Search "CrowdStrike" > Install

# Step 2: Create API credentials in Falcon
Scopes: Event Streams (Read), Detections (Read)

# Step 3: Add Log Source
Admin > Log Sources > Add
Log Source Type:    CrowdStrike Falcon
Protocol:          CrowdStrike Falcon Streaming API
Client ID/Secret:  <from Falcon Console>

# Step 4: Verify events flowing
# Log Activity > Filter: Log Source = CrowdStrike Falcon

SOAR Integrations

Palo Alto XSOAR

Settings > Integrations > Search "CrowdStrike Falcon". Configure with API Client ID/Secret. Enables automated containment, IOC push, and detection triage playbooks.

Splunk SOAR

Apps > CrowdStrike Falcon > Configure asset with API keys. Run actions: contain host, list detections, get device info, quarantine file.

Microsoft Sentinel Playbooks

Use Logic Apps with CrowdStrike connector. Automate: isolate host on critical detection, enrich incidents with Falcon data, sync IOCs bidirectionally.

Ticketing & Alerting

ServiceNow

Install CrowdStrike app from ServiceNow Store. Configure OAuth 2.0 with Falcon API. Auto-create incidents from Critical/High detections. Bidirectional status sync.

Jira

Use Falcon Fusion workflows or SOAR integration to auto-create Jira tickets. Map severity to priority, include detection details and host info in ticket body.

PagerDuty

Configure Falcon Notification workflows to trigger PagerDuty incidents via Events API v2. Route by severity: Critical = P1, High = P2. Include runbook links.

MITRE ATT&CK Coverage

CrowdStrike Falcon coverage mapped across all 14 MITRE ATT&CK Enterprise tactics.

Tactic	ID	Key Technique	CS Rule	Severity	Coverage

Claude AI Prompts

Ready-to-use prompts for leveraging Claude AI across your CrowdStrike POC workflow. Click copy and paste directly into Claude.

POC Terminal

Simulated command terminal for quick reference. Type help to see available commands.

CrowdStrike POC Terminal v1.0

CrowdStrike Falcon POC Terminal v1.0

Type 'help' for available commands.

---

falcon >

POC Report Generator

Generate a professional POC executive report from your evaluation data.

Client Information

Client Name

Industry

POC Duration

Endpoints Evaluated

Threats Demonstrated

Prevention Rate: 95%