Please share with the community what you think needs improvement with CrowdStrike Falcon Complete.
What are its weaknesses? What would you like to see changed in a future version?
We have also been using Cisco AMP for Endpoints for three years. We have received multiple detections in Cisco AMP for Endpoints, and we had to take some actions, whereas CrowdStrike has not detected anything critical since it has been implemented. Most of the incidents that it has detected are false positives. They should work on the false-positive issue. When it is implemented throughout the organization, it gets very difficult to check each false positive and investigate what is correct and what is not correct. It requires technical and manual intervention.
People should be able to obtain training at any point of the engagement so that if somebody who doesn't have the basic knowledge is getting thrown into it, they are able to get trained, and CrowdStrike is able to help them out. CrowdStrike is really doing what they're supposed to be doing, but it is like anything else where they have to keep up on their research and development, or they'll fall behind. This is a fast-paced environment, and I've seen that vendors that were really good three years ago are terrible now. CrowdStrike is trying to stay ahead of the bad guys. They have AI. I have not had a problem with them missing anything. If they missed something, they should just make sure that they don't miss it again and understand why they missed it. I don't know if they did.
Its support should be improved. The product is amazing, but the problem is that their support team is overconfident about the product. If something happens, they don't listen. They keep arguing with the customer. It should have more reporting. Reports are not that customizable. We need customizable reports for our customers, but they not there in CrowdStrike as well as SentinelOne.
All of our customers complain about the reporting and say that it is very poor. Technical support in Latin America could be improved. It is not difficult to use and it is fast to implement. I would like to have a feature to collect logs and explore the information. In the next release, I would like to have a simplified remote installation.
The solution doesn't actually scan desktops. They prevent execution and they do a very, very, very good job at that. However, if there is malware, et cetera, on an endpoint, there's not a scan feature to simply remove it. You have to go in and clean the registry and do the other stuff yourself. It would be ideal if there was some sort of scanning functionality built-in. The logging features aren't robust and the information isn't kept long enough. The active logs are only retained for seven days. It would be better if it was available for, let's say, 30 days. If we were going to do any forensics, we would have the time to execute them.
Some dashboards can be very complex, but once you get to know them, it is very logical.
The downside that we see with CrowdStrike is that it is not part of a broader ecosystem. It is an endpoint product. They don't sell firewalls or a broader cybersecurity ecosystem. Some of the behavioral detections could be more robust. It does a good job of stopping common tools and techniques, but when it comes to using Windows utilities, such as PowerShell, etc, it doesn't stop them. These are some of the things where we have been able to get past it. An argument there can be that these are administrative tools, not malware, so maybe it is not its job to stop it, but we see some of the competitive products doing a very good job of detecting behaviors as opposed to malware.
The documentation that they had for the use of their API's was not very helpful. It took us a lot of time to work through their API on how to do it programmatically. Aside from that, we really have not had very much trouble with Crowdstrike. For an upcoming feature, adding more Linux support for real time response analytics would be helpful. This might be on their roadmap, or maybe even in a very pending release.
There are some parts of this solution that are too slow. The performance slows down by between 10% and 40%, depending on what type of work the machine is doing. For example, we had to shut down our backup because it was too slow and it started to overlap with other tasks. We did not try to use our SQL database because there was too much of an impact. This is not on the network but on the machine and even a few percentage points difference is significant for us because of the volume of transactions. Integration slows down the system a bit. I would like to have an alternate dashboard view, which is somewhat simpler. The one it presents now is like Splunk, and it is very good, but it would be helpful to have a simpler one that only shows the basics like what you have and what it has found. As it is now, it takes time to get used to it. After a while, it won't be a problem for me or other users in the company. When you're working with a regular antivirus, it is much easier to set up and start using.
The reporting could be better. It's not as good as it could be. If they could improve that a bit, and make it more robust, that would be ideal.
The solution could offer integration with some additional solutions - for example, vulnerability scanners. In a future release, it would be ideal if they could add reporting and action histories to their suite of features.
I don't think the solution is really missing any features. We're a small organization. I'm not sure how it would fare if you were larger and had more and more users and added complexity.
The solution isn't missing any features at this point. It's ticking all the boxes for our organization. There really isn't anything that I can see that would make me want to change providers. The customization could be tweaked. We can do a bunch of custom dashboards. However, the one thing that I'm not a fan of is when you go to do an investigation, the way that the processes are laid out on the screen is very bland looking. While the information is there, it could be laid out better. I've seen other products like Cisco Secure that gives you a better view of the issues. Cisco just presents the data differently, and it's easier to look at.
It would be nice to have full-scale ESR reporting. In the future, I would like to see better reporting and better SIEM integration.
At this stage, I don't really see room for improvement. I do think because the IP security market and the threat landscape is moving along so quickly, there's always room for improvement and there are always new elements one has to look at and look at in-depth, but at this stage, OverWatch is much better than the competitors. And I've seen a lot of their competitors.
We all know it's really hard to get good pricing and cost information.
Please share what you can so you can help your peers.