CrowdStrike Delivers the Next Generation of SIEM to Power the AI-Native SOC
CrowdStrike Delivers the Next Generation of SIEM to Power the AI-Native SOC
Falcon Next-Gen SIEM innovations modernize SOC operations with a single, unified platform to deliver full visibility and protection across all workloads; Falcon Insight customers receive 10 gigabytes of third-party data per day at no additional cost
Falcon 下一代 SIEM 創新通過單一統一平台實現 SOC 運營現代化，爲所有工作負載提供全面的可見性和保護；Falcon Insight 客戶每天可獲得 10 GB 的第三方數據，無需額外付費
AUSTIN, Texas--(BUSINESS WIRE)--May 7, 2024-- RSA Conference 2024 -- CrowdStrike (NASDAQ: CRWD) today announced new CrowdStrike Falcon Next-Gen SIEM innovations to liberate customers from the constraints of legacy SIEM products and power the AI-Native SOC. To accelerate SOC transformation, all Falcon Insight customers will receive 10 gigabytes of third-party data ingest per day at no additional cost to experience the speed and performance of Falcon Next-Gen SIEM.
德克薩斯州奧斯汀--(美國商業資訊)--2024年5月7日-- 2024 年 RSA 會議- CrowdSt 納斯達克股票代碼：CRWD）今天宣佈了新的 CrowdStrike Falcon 次世代 通過創新將客戶從傳統 SIEM 產品的限制中解放出來，爲 AI 原生 SOC 提供動力。爲了加速SOC轉型，所有Falcon Insight客戶每天都將免費獲得10千兆字節的第三方數據，以體驗獵鷹下一代SIEM的速度和性能。
With breakout times now measured in minutes, stopping breaches requires security operations to match the speed of the adversary. Legacy SIEMs are too slow and complex to deliver the security outcomes customers require. SIEMs have become data dumping grounds, forcing security analysts to navigate multiple data sources, tools and consoles to extract meaning from data and conduct investigations. At the same time, point products positioned as SIEM alternatives struggle with slow search speeds, limited data visualization and investigation options, and a data onboarding process that requires lengthy deployments while driving up overall costs. To give security teams the speed they need to stop breaches, the modern SOC requires a platform that converges data, security and IT, with AI and workflow automation built natively within. With this release, CrowdStrike sets the standard for the next generation of SIEM, engineered to power the AI-native SOC.
現在的突破時間以分鐘爲單位，阻止漏洞需要安全操作與對手的速度相匹配。傳統的 SIEM 過於緩慢和複雜，無法提供客戶所需的安全成果。SIEM已成爲數據傾倒場，迫使安全分析師瀏覽多個數據源、工具和控制檯，從數據中提取意義並進行調查。同時，定位爲SIEM替代品的點式產品在搜索速度緩慢、數據可視化和調查選項有限以及需要漫長部署同時推高總體成本的數據載入流程等問題上苦苦掙扎。爲了給安全團隊提供阻止漏洞所需的速度，現代 SOC 需要一個融合數據、安全和IT的平台，並在其中原生內置人工智能和工作流程自動化。在此版本中，CrowdStrike爲下一代SIEM設定了標準，該SIEM旨在爲人工智能原生SOC提供動力。
"The speed of today's cyberattacks requires security teams to rapidly analyze massive amounts of data to detect, investigate and respond to threats faster. This is the failed promise of SIEM. Customers are hungry for better technology that delivers instant time-to-value and increased functionality at a lower total cost of ownership," said George Kurtz, CEO and co-founder, CrowdStrike. "The vast majority of the critical security data is already resident in the Falcon platform, saving the time and cost of data transfer to a legacy SIEM. Our single-agent, single platform architecture unifies native and third-party data with AI and workflow automation to deliver on the promise of the AI-native SOC."
“當今網絡攻擊的速度要求安全團隊快速分析大量數據，以更快地檢測、調查和應對威脅。這是 SIEM 未能兌現的承諾。CrowdStrike首席執行官兼聯合創始人George Kurtz說，客戶渴望更好的技術，以較低的總擁有成本提供即時實現價值和增強的功能。“絕大多數關鍵安全數據已經存在於Falcon平台中，從而節省了向傳統SIEM傳輸數據的時間和成本。我們的單代理單平台架構將原生和第三方數據與人工智能和工作流程自動化相結合，以兌現人工智能原生 SOC 的承諾。”
The AI-Native SOC: Full Visibility. Faster Detection and Response.
人工智能原生 SOC：完全可見性。更快的檢測和響應。
Falcon Next-Gen SIEM is the industry's answer to power the AI-Native SOC, delivering up to 150x faster search performance and an 80% lower total cost of ownership than legacy SIEMs and solutions positioned as SIEM alternatives. New and expanded innovations in the latest Falcon Next-Gen SIEM release include:
Falcon Next-Gen SIEM 是業界爲 AI 原生 SOC 提供動力的答案，與之相比，其搜索性能最多可提高 150 倍，總擁有成本降低了 80% 傳統 SIEM 以及定位爲 SIEM 替代方案的解決方案。最新的 Falcon 下一代 SIEM 版本中的新增和擴展創新包括：
Generative AI and Workflow Automation:
生成式 AI 和工作流程自動化：
- Charlotte AI for all Falcon Data: Charlotte AI, CrowdStrike's Generative AI security analyst which transforms every user into a power user, is now available for all Falcon data in Next Gen SIEM. Analysts can ask any question of Falcon data in the Falcon platform, as well as from product documentation or Knowledge Bases, in plain language and get an answer back in seconds.
- Investigate with Charlotte AI: Transforms the speed and efficiency of investigations by automatically correlating all related context into a single incident and generates an LLM-powered incident summary for understanding by security analysts of all skill levels.
- New GenAI Promptbooks: New out-of-the-box promptbooks drive the most common analyst workflows across detection, investigation, hunting, and response with velocity. Teams can further define custom prompts to standardize and re-use specific detection and response workflows to go from incident to action with greater speed and efficiency.
- Native SIEM and SOAR Integration: Falcon Fusion SOAR provides a newly modernized UI for a drag and drop experience to create playbooks and workflows, accelerating detection, investigation and response. Falcon Next-Gen SIEM includes a growing library of integrations and actions to automate critical security and IT use cases across siloed teams and tools.
- Automated Investigations and Threat Hunting: Falcon Fusion SOAR brings workflow automation to threat investigation and hunting. Analysts can automatically query all data in Falcon Next-Gen SIEM and close the loop by visualizing the results or orchestrating action across Falcon and third-party tools.
- 所有獵鷹數據的夏洛特人工智能： CrowdStrike的生成式人工智能安全分析師Charlotte AI將每位用戶轉變爲高級用戶，現在可用於下一代SIEM中的所有獵鷹數據。分析師可以在Falcon平台以及產品文檔或知識庫中以通俗易懂的語言詢問有關Falcon數據的任何問題，並在幾秒鐘內得到答案。
- 使用夏洛特 AI 進行調查：通過自動將所有相關背景關聯爲單個事件，提高調查的速度和效率，並生成由 LLM 提供支持的事件摘要，以供所有技能水平的安全分析師理解。
- 新的 GenAI 提示手冊：新的開箱即用提示簿推動了最常見的分析師工作流程，包括檢測、調查、搜捕和快速響應。團隊可以進一步定義自定義提示，以標準化和重複使用特定的檢測和響應工作流程，以更快的速度和效率將事件轉化爲行動。
- 原生 SIEM 和 SOAR 集成： Falcon Fusion SOAR 爲拖放體驗提供了全新的現代化用戶界面，可創建劇本和工作流程，加速檢測、調查和響應。Falcon 下一代 SIEM 包括不斷增長的集成和操作庫，用於在孤立的團隊和工具中自動執行關鍵安全和IT用例。
- 自動調查和威脅搜尋： Falcon Fusion SOAR 爲威脅調查和狩獵帶來了工作流程自動化。分析師可以自動查詢Falcon Next-Gen SIEM中的所有數據，並通過可視化結果或協調Falcon和第三方工具的操作來結束循環。
Rapid Data Ingestion to Consolidate Detection and Response:
快速提取數據以整合檢測和響應：
- Expanded Data Ecosystem: Falcon Next-Gen SIEM includes new and updated connectors to consolidate third-party IT and security data into the unified Falcon platform.
- New Cloud Connectors: Includes comprehensive connectors for AWS, Azure, and GCP. AWS coverage includes all key cloud services such as GuardDuty, Security Hub, and S3 Access Logs. Azure connectors include Microsoft Defender for Cloud and Microsoft Exchange Online.
- Automated Data Normalization on a Common Standard: Data onboarding is streamlined and made easy with new parsers. Automated normalization of third-party data on the new CrowdStrike Parsing Standard creates a common understanding that drives rapid, accurate detection and response across all data sources.
- Automated SIEM Data On-boarding: New data management capabilities make it easy to understand the health, volume, and status of data ingestion, as well as manage and edit custom parsers to easily bring in new data sources, including on-premises log collectors.
- 擴展的數據生態系統：Falcon 下一代 SIEM 包括新的和更新的連接器，用於將第三方 IT 和安全數據整合到統一的 Falcon 平台中。
- 新的雲連接器： 包括適用於 AWS、Azure 和 GCP 的全面連接器。AWS 覆蓋範圍包括所有關鍵雲服務，例如 GuardDuty、安全中心和 S3 訪問日誌。Azure 連接器包括微軟雲端防禦者和微軟在線交易所。
- 基於通用標準的自動數據標準化： 藉助新的解析器，數據載入簡化並變得容易。在新的CrowdStrike解析標準上對第三方數據進行自動標準化可以達成共識，從而推動對所有數據源進行快速、準確的檢測和響應。
- 自動加載 SIEM 數據：新的數據管理功能使您可以輕鬆了解數據攝取的運行狀況、數量和狀態，還可以管理和編輯自定義解析器以輕鬆引入新的數據源，包括本地日誌收集器。
A Modern Analyst Experience with Incident Workbench Innovations:
藉助事件工作臺創新的現代分析師體驗：
- Automated Incident Enrichment: New automated enrichment capabilities adds context to indicators that an analyst adds to an incident for complete context from the Falcon platform, including adversary TTPs, host and user data and associated vulnerabilities - slashing investigation time.
- Case Management and Incident Collaboration: New and enhanced features support analyst collaboration and ease of use, including a simplified user experience with customized views, direct access to Advanced Event Search from the Incident Workbench, severity and naming modification and automated change notifications when another analyst adds a note.
- Add Threat Intelligence with Custom Lookup Files: Easily add threat intelligence or custom content to Falcon Next-Gen SIEM to drive searches, without cumbersome manual processes.
- 自動充實事件： 新的自動擴充功能爲分析師在事件中添加的指標增加了背景信息，以獲取來自Falcon平台的完整背景信息，包括對手的TTP、主機和用戶數據以及相關的漏洞，從而縮短了調查時間。
- 案例管理和事件協作： 新的和增強的功能支持分析師的協作和易用性，包括通過自定義視圖簡化用戶體驗、從事件工作臺直接訪問高級事件搜索、嚴重程度和命名修改以及在另一位分析師添加備註時自動發送變更通知。
- 使用自定義查詢文件添加威脅情報： 輕鬆向Falcon Next-Gen SIEM添加威脅情報或自定義內容以推動搜索，無需繁瑣的手動流程。
Falcon Next-Gen SIEM is generally available. For more information:
獵鷹下一代 SIEM 現已正式上市。欲了解更多信息：
- Get a demo at RSA, booth #N-6144
- Register for the virtual AI-Native SOC Summit
- Visit the Falcon Next-Gen SIEM page or request a free virtual test drive.
About CrowdStrike
關於 CrowdStri
CrowdStrike (Nasdaq: CRWD), a global cybersecurity leader, has redefined modern security with the world's most advanced cloud-native platform for protecting critical areas of enterprise risk – endpoints and cloud workloads, identity and data.
CrowdSt 全球網絡安全領導者納斯達克股票代碼：CRWD）通過世界上最先進的雲原生平台重新定義了現代安全，用於保護企業風險的關鍵領域——端點和雲工作負載、身份和數據。
Powered by the CrowdStrike Security Cloud and world-class AI, the CrowdStrike Falcon platform leverages real-time indicators of attack, threat intelligence, evolving adversary tradecraft and enriched telemetry from across the enterprise to deliver hyper-accurate detections, automated protection and remediation, elite threat hunting and prioritized observability of vulnerabilities.
CrowdStrike Falcon平台由CrowdStrike Security Cloud和世界一流的人工智能提供支持，利用攻擊的實時指標、威脅情報、不斷演變的對手貿易手段以及來自整個企業的豐富遙測來提供超精確的檢測、自動保護和補救、精英威脅搜尋以及漏洞的優先可觀察性。
Purpose-built in the cloud with a single lightweight-agent architecture, the Falcon platform delivers rapid and scalable deployment, superior protection and performance, reduced complexity and immediate time-to-value.
Falcon 平台在雲中專門構建，採用單一輕量級代理架構，可提供快速且可擴展的部署、卓越的保護和性能、更低的複雜性以及即時實現價值的時間。
CrowdStrike: We stop breaches.
CrowdStrike：我們阻止違規行爲。
Learn more: https://www.crowdstrike.com/
Follow us: Blog | Twitter | LinkedIn | Facebook | Instagram
Start a free trial today: https://www.crowdstrike.com/free-trial-guide/
了解更多： https://www.crowdstrike.com/
關注我們： 博客 | 推特 | 領英 | Facebook | Instagram
立即開始免費試用： https://www.crowdstrike.com/free-trial-guide/
2024 CrowdStrike, Inc. All rights reserved. CrowdStrike, the falcon logo, CrowdStrike Falcon and CrowdStrike Threat Graph are marks owned by CrowdStrike, Inc. and registered with the United States Patent and Trademark Office, and in other countries. CrowdStrike owns other trademarks and service marks, and may use the brands of third parties to identify their products and services.
2024 CrowdStrike, Inc. 版權所有。CrowdStrike、獵鷹徽標、CrowdStrike Falcon 和 CrowdStrike Threat Graph 是 CrowdStrike, Inc. 擁有並在美國專利商標局和其他國家註冊的商標。CrowdStrike擁有其他商標和服務標誌，並可能使用第三方的品牌來識別其產品和服務。
View source version on businesswire.com: https://www.businesswire.com/news/home/20240507009784/en/
Media Contact
Jake Schuster
CrowdStrike Corporate Communications
press@crowdstrike.com
媒體聯繫人
傑克·舒斯特
CrowdStrike 企業
press@crowdstrike.com
Source: CrowdStrike, Inc.
資料來源：CrowdStrike, Inc.