Install the CrowdStrike Falcon Endpoint Protection App and view the Dashboards
This page provides instructions for installing the Sumo App for CrowdStrike Falcon Endpoint Protection, as well as examples for each of the app dashboards.
Install the App
This section demonstrates how to install the CrowdStrike Falcon Endpoint Protection App.
To install the app, do the following:
Dashboard Filter with Template Variables
Template variables provide dynamic dashboards that rescope data on the fly. As you apply variables to troubleshoot through your dashboard, you can view dynamic changes to the data for a fast resolution to the root cause. For more information, see the Filter with template variables help page.
Parsers/FERs Folder
The app includes a "Parsers/FERs" folder that has pre-built searches to help in your investigations. These searches parse out commonly used fields for audit activity, detection summary, incident summary and remote response session events.
CrowdStrike Falcon - Overview
The CrowdStrike Falcon - Overview dashboard provides high-level visibility into the state of endpoints that are managed by the ClowdStrike Falcon platform. Panels provide insights into events, detections, authentications, and detection status updates for overall security posture and analysis of user activities.
Use this dashboard to:
- Understand the overall security posture of your environment as analyzed by CrowdStrike Falcon deployed in your network.
- Analyze user activities within the Falcon Console.
- Review all detection updates.
CrowdStrike Falcon - Authentication
The CrowdStrike Falcon - Authentication dashboard provides visibility into authentication-related user activities and their geographic locations. Panels also display detailed information for authentication comparisons and trends, requested auth secrets, 2-factor authentication, API client events, and failed events.
Use this dashboard to:
- Analyze user activities within your Falcon Console and the geographic location of the users responsible for these activities.
- Identify failed authentication events, user logins with and without 2-factor authentication.
- Detect OAuth2 API key access events.
CrowdStrike Falcon - Detections
The CrowdStrike Falcon - Detections dashboard provides visibility into malicious behavior in your environment, where you can analyze group detections, discover blocked detections, and analyze detection trends by type. Panels also display a detailed analysis of detected malware and help quickly identify hosts with the most detected malware.
Use this dashboard to:
- Investigate malicious behavior across your endpoints.
- Analyze group detections by users, tactic, technique, and objective.
- Discover trending IOCs in your network.
- Identify malicious attempts that were blocked by CrowdStrike Falcon.
- Review detailed analysis of malware detected in the Detection Summary panel.
- Find hosts in your network with the most detected malware. Use pre-built links to go to the Falcon Console, so as to assign detection events and take action.
CrowdStrike Falcon - Detection Status Update
The CrowdStrike Falcon - Detection Status Update dashboard provides high-level and detailed insights into the status of severity event detection in your CrowdStrike environment. Panels display event geographic locations, event classification by operation, details on quarantined files, and updates on policies and groups.
Use this dashboard to:
- Find and analyze any updates to malware detections by CrowdStrike Falcon users.
- Identify quarantined files.
Crowdstrike Falcon - Incident Summary Events
The CrowdStrike - Falcon - Incident Summary Events dashboard provides visibility into Falcon incidents, event trends, and risk.
Use this dashboard to:
- Get an overview of incidents created and their risk.
- Identify unexpected events related to incidents by examining trends.
- Drill-down to the details of an incident using pre-built links in the CrowdStrike Falcon Console.