CrowdStrike Delivers the Next Generation of SIEM to Power the AI-Native SOC
CrowdStrike Delivers the Next Generation of SIEM to Power the AI-Native SOC
Falcon Next-Gen SIEM innovations modernize SOC operations with a single, unified platform to deliver full visibility and protection across all workloads; Falcon Insight customers receive 10 gigabytes of third-party data per day at no additional cost
Falcon 下一代 SIEM 创新通过单一统一平台实现 SOC 运营现代化，为所有工作负载提供全面的可见性和保护；Falcon Insight 客户每天可获得 10 GB 的第三方数据，无需额外付费
AUSTIN, Texas--(BUSINESS WIRE)--May 7, 2024-- RSA Conference 2024 -- CrowdStrike (NASDAQ: CRWD) today announced new CrowdStrike Falcon Next-Gen SIEM innovations to liberate customers from the constraints of legacy SIEM products and power the AI-Native SOC. To accelerate SOC transformation, all Falcon Insight customers will receive 10 gigabytes of third-party data ingest per day at no additional cost to experience the speed and performance of Falcon Next-Gen SIEM.
德克萨斯州奥斯汀--(美国商业资讯)--2024年5月7日-- 2024 年 RSA 会议- CrowdSt 纳斯达克股票代码：CRWD）今天宣布了新的 CrowdStrike Falcon 次世代 通过创新将客户从传统 SIEM 产品的限制中解放出来，为 AI 原生 SOC 提供动力。为了加速SOC转型，所有Falcon Insight客户每天都将免费获得10千兆字节的第三方数据，以体验猎鹰下一代SIEM的速度和性能。
With breakout times now measured in minutes, stopping breaches requires security operations to match the speed of the adversary. Legacy SIEMs are too slow and complex to deliver the security outcomes customers require. SIEMs have become data dumping grounds, forcing security analysts to navigate multiple data sources, tools and consoles to extract meaning from data and conduct investigations. At the same time, point products positioned as SIEM alternatives struggle with slow search speeds, limited data visualization and investigation options, and a data onboarding process that requires lengthy deployments while driving up overall costs. To give security teams the speed they need to stop breaches, the modern SOC requires a platform that converges data, security and IT, with AI and workflow automation built natively within. With this release, CrowdStrike sets the standard for the next generation of SIEM, engineered to power the AI-native SOC.
现在的突破时间以分钟为单位，阻止漏洞需要安全操作与对手的速度相匹配。传统的 SIEM 过于缓慢和复杂，无法提供客户所需的安全成果。SIEM已成为数据倾倒场，迫使安全分析师浏览多个数据源、工具和控制台，从数据中提取意义并进行调查。同时，定位为SIEM替代品的点式产品在搜索速度缓慢、数据可视化和调查选项有限以及需要漫长部署同时推高总体成本的数据载入流程等问题上苦苦挣扎。为了给安全团队提供阻止漏洞所需的速度，现代 SOC 需要一个融合数据、安全和IT的平台，并在其中原生内置人工智能和工作流程自动化。在此版本中，CrowdStrike为下一代SIEM设定了标准，该SIEM旨在为人工智能原生SOC提供动力。
"The speed of today's cyberattacks requires security teams to rapidly analyze massive amounts of data to detect, investigate and respond to threats faster. This is the failed promise of SIEM. Customers are hungry for better technology that delivers instant time-to-value and increased functionality at a lower total cost of ownership," said George Kurtz, CEO and co-founder, CrowdStrike. "The vast majority of the critical security data is already resident in the Falcon platform, saving the time and cost of data transfer to a legacy SIEM. Our single-agent, single platform architecture unifies native and third-party data with AI and workflow automation to deliver on the promise of the AI-native SOC."
“当今网络攻击的速度要求安全团队快速分析大量数据，以更快地检测、调查和应对威胁。这是 SIEM 未能兑现的承诺。CrowdStrike首席执行官兼联合创始人George Kurtz说，客户渴望更好的技术，以较低的总拥有成本提供即时实现价值和增强的功能。“绝大多数关键安全数据已经存在于Falcon平台中，从而节省了向传统SIEM传输数据的时间和成本。我们的单代理单平台架构将原生和第三方数据与人工智能和工作流程自动化相结合，以兑现人工智能原生 SOC 的承诺。”
The AI-Native SOC: Full Visibility. Faster Detection and Response.
人工智能原生 SOC：完全可见性。更快的检测和响应。
Falcon Next-Gen SIEM is the industry's answer to power the AI-Native SOC, delivering up to 150x faster search performance and an 80% lower total cost of ownership than legacy SIEMs and solutions positioned as SIEM alternatives. New and expanded innovations in the latest Falcon Next-Gen SIEM release include:
Falcon Next-Gen SIEM 是业界为 AI 原生 SOC 提供动力的答案，与之相比，其搜索性能最多可提高 150 倍，总拥有成本降低了 80% 传统 SIEM 以及定位为 SIEM 替代方案的解决方案。最新的 Falcon 下一代 SIEM 版本中的新增和扩展创新包括：
Generative AI and Workflow Automation:
生成式 AI 和工作流程自动化：
- Charlotte AI for all Falcon Data: Charlotte AI, CrowdStrike's Generative AI security analyst which transforms every user into a power user, is now available for all Falcon data in Next Gen SIEM. Analysts can ask any question of Falcon data in the Falcon platform, as well as from product documentation or Knowledge Bases, in plain language and get an answer back in seconds.
- Investigate with Charlotte AI: Transforms the speed and efficiency of investigations by automatically correlating all related context into a single incident and generates an LLM-powered incident summary for understanding by security analysts of all skill levels.
- New GenAI Promptbooks: New out-of-the-box promptbooks drive the most common analyst workflows across detection, investigation, hunting, and response with velocity. Teams can further define custom prompts to standardize and re-use specific detection and response workflows to go from incident to action with greater speed and efficiency.
- Native SIEM and SOAR Integration: Falcon Fusion SOAR provides a newly modernized UI for a drag and drop experience to create playbooks and workflows, accelerating detection, investigation and response. Falcon Next-Gen SIEM includes a growing library of integrations and actions to automate critical security and IT use cases across siloed teams and tools.
- Automated Investigations and Threat Hunting: Falcon Fusion SOAR brings workflow automation to threat investigation and hunting. Analysts can automatically query all data in Falcon Next-Gen SIEM and close the loop by visualizing the results or orchestrating action across Falcon and third-party tools.
- 所有猎鹰数据的夏洛特人工智能： CrowdStrike的生成式人工智能安全分析师Charlotte AI将每位用户转变为高级用户，现在可用于下一代SIEM中的所有猎鹰数据。分析师可以在Falcon平台以及产品文档或知识库中以通俗易懂的语言询问有关Falcon数据的任何问题，并在几秒钟内得到答案。
- 使用夏洛特 AI 进行调查：通过自动将所有相关背景关联为单个事件，提高调查的速度和效率，并生成由 LLM 提供支持的事件摘要，以供所有技能水平的安全分析师理解。
- 新的 GenAI 提示手册：新的开箱即用提示簿推动了最常见的分析师工作流程，包括检测、调查、搜捕和快速响应。团队可以进一步定义自定义提示，以标准化和重复使用特定的检测和响应工作流程，以更快的速度和效率将事件转化为行动。
- 原生 SIEM 和 SOAR 集成： Falcon Fusion SOAR 为拖放体验提供了全新的现代化用户界面，可创建剧本和工作流程，加速检测、调查和响应。Falcon 下一代 SIEM 包括不断增长的集成和操作库，用于在孤立的团队和工具中自动执行关键安全和IT用例。
- 自动调查和威胁搜寻： Falcon Fusion SOAR 为威胁调查和狩猎带来了工作流程自动化。分析师可以自动查询Falcon Next-Gen SIEM中的所有数据，并通过可视化结果或协调Falcon和第三方工具的操作来结束循环。
Rapid Data Ingestion to Consolidate Detection and Response:
快速提取数据以整合检测和响应：
- Expanded Data Ecosystem: Falcon Next-Gen SIEM includes new and updated connectors to consolidate third-party IT and security data into the unified Falcon platform.
- New Cloud Connectors: Includes comprehensive connectors for AWS, Azure, and GCP. AWS coverage includes all key cloud services such as GuardDuty, Security Hub, and S3 Access Logs. Azure connectors include Microsoft Defender for Cloud and Microsoft Exchange Online.
- Automated Data Normalization on a Common Standard: Data onboarding is streamlined and made easy with new parsers. Automated normalization of third-party data on the new CrowdStrike Parsing Standard creates a common understanding that drives rapid, accurate detection and response across all data sources.
- Automated SIEM Data On-boarding: New data management capabilities make it easy to understand the health, volume, and status of data ingestion, as well as manage and edit custom parsers to easily bring in new data sources, including on-premises log collectors.
- 扩展的数据生态系统：Falcon 下一代 SIEM 包括新的和更新的连接器，用于将第三方 IT 和安全数据整合到统一的 Falcon 平台中。
- 新的云连接器： 包括适用于 AWS、Azure 和 GCP 的全面连接器。AWS 覆盖范围包括所有关键云服务，例如 GuardDuty、安全中心和 S3 访问日志。Azure 连接器包括微软云端防御者和微软在线交易所。
- 基于通用标准的自动数据标准化： 借助新的解析器，数据载入简化并变得容易。在新的CrowdStrike解析标准上对第三方数据进行自动标准化可以达成共识，从而推动对所有数据源进行快速、准确的检测和响应。
- 自动加载 SIEM 数据：新的数据管理功能使您可以轻松了解数据摄取的运行状况、数量和状态，还可以管理和编辑自定义解析器以轻松引入新的数据源，包括本地日志收集器。
A Modern Analyst Experience with Incident Workbench Innovations:
借助事件工作台创新的现代分析师体验：
- Automated Incident Enrichment: New automated enrichment capabilities adds context to indicators that an analyst adds to an incident for complete context from the Falcon platform, including adversary TTPs, host and user data and associated vulnerabilities - slashing investigation time.
- Case Management and Incident Collaboration: New and enhanced features support analyst collaboration and ease of use, including a simplified user experience with customized views, direct access to Advanced Event Search from the Incident Workbench, severity and naming modification and automated change notifications when another analyst adds a note.
- Add Threat Intelligence with Custom Lookup Files: Easily add threat intelligence or custom content to Falcon Next-Gen SIEM to drive searches, without cumbersome manual processes.
- 自动充实事件： 新的自动扩充功能为分析师在事件中添加的指标增加了背景信息，以获取来自Falcon平台的完整背景信息，包括对手的TTP、主机和用户数据以及相关的漏洞，从而缩短了调查时间。
- 案例管理和事件协作： 新的和增强的功能支持分析师的协作和易用性，包括通过自定义视图简化用户体验、从事件工作台直接访问高级事件搜索、严重程度和命名修改以及在另一位分析师添加备注时自动发送变更通知。
- 使用自定义查询文件添加威胁情报： 轻松向Falcon Next-Gen SIEM添加威胁情报或自定义内容以推动搜索，无需繁琐的手动流程。
Falcon Next-Gen SIEM is generally available. For more information:
猎鹰下一代 SIEM 现已正式上市。欲了解更多信息：
- Get a demo at RSA, booth #N-6144
- Register for the virtual AI-Native SOC Summit
- Visit the Falcon Next-Gen SIEM page or request a free virtual test drive.
About CrowdStrike
关于 CrowdStri
CrowdStrike (Nasdaq: CRWD), a global cybersecurity leader, has redefined modern security with the world's most advanced cloud-native platform for protecting critical areas of enterprise risk – endpoints and cloud workloads, identity and data.
CrowdSt 全球网络安全领导者纳斯达克股票代码：CRWD）通过世界上最先进的云原生平台重新定义了现代安全，用于保护企业风险的关键领域——端点和云工作负载、身份和数据。
Powered by the CrowdStrike Security Cloud and world-class AI, the CrowdStrike Falcon platform leverages real-time indicators of attack, threat intelligence, evolving adversary tradecraft and enriched telemetry from across the enterprise to deliver hyper-accurate detections, automated protection and remediation, elite threat hunting and prioritized observability of vulnerabilities.
CrowdStrike Falcon平台由CrowdStrike Security Cloud和世界一流的人工智能提供支持，利用攻击的实时指标、威胁情报、不断演变的对手贸易手段以及来自整个企业的丰富遥测来提供超精确的检测、自动保护和补救、精英威胁搜寻以及漏洞的优先可观察性。
Purpose-built in the cloud with a single lightweight-agent architecture, the Falcon platform delivers rapid and scalable deployment, superior protection and performance, reduced complexity and immediate time-to-value.
Falcon 平台在云中专门构建，采用单一轻量级代理架构，可提供快速且可扩展的部署、卓越的保护和性能、更低的复杂性以及即时实现价值的时间。
CrowdStrike: We stop breaches.
CrowdStrike：我们阻止违规行为。
Learn more: https://www.crowdstrike.com/
Follow us: Blog | Twitter | LinkedIn | Facebook | Instagram
Start a free trial today: https://www.crowdstrike.com/free-trial-guide/
了解更多： https://www.crowdstrike.com/
关注我们： 博客 | 推特 | 领英 | Facebook | Instagram
立即开始免费试用： https://www.crowdstrike.com/free-trial-guide/
2024 CrowdStrike, Inc. All rights reserved. CrowdStrike, the falcon logo, CrowdStrike Falcon and CrowdStrike Threat Graph are marks owned by CrowdStrike, Inc. and registered with the United States Patent and Trademark Office, and in other countries. CrowdStrike owns other trademarks and service marks, and may use the brands of third parties to identify their products and services.
2024 CrowdStrike, Inc. 版权所有。CrowdStrike、猎鹰徽标、CrowdStrike Falcon 和 CrowdStrike Threat Graph 是 CrowdStrike, Inc. 拥有并在美国专利商标局和其他国家注册的商标。CrowdStrike拥有其他商标和服务标志，并可能使用第三方的品牌来识别其产品和服务。
View source version on businesswire.com: https://www.businesswire.com/news/home/20240507009784/en/
Media Contact
Jake Schuster
CrowdStrike Corporate Communications
press@crowdstrike.com
媒体联系人
杰克·舒斯特
CrowdStrike 企业
press@crowdstrike.com
Source: CrowdStrike, Inc.
资料来源：CrowdStrike, Inc.