ENDPOINT SECURITY • EDR • SIEM • INCIDENT RESPONSE

CrowdStrike Falcon Endpoint Detection & Response

A multi-endpoint CrowdStrike Falcon deployment focused on endpoint visibility, prevention, behavioral detections, MITRE ATT&CK mapping, SIEM analytics, SOAR automation, network containment, and recovery.

I deployed and configured CrowdStrike Falcon across four Windows systems, organized endpoints into security groups, applied role-based prevention policies, validated sensor communication, generated controlled detection activity, investigated process trees, confirmed process blocking, reviewed MITRE ATT&CK mappings, tested on-demand malware scanning, configured Fusion SOAR workflows, and performed endpoint containment and recovery.

Back to Projects

Project Snapshot

The project was designed around the full endpoint-security lifecycle instead of stopping at sensor installation. I validated deployment, policy enforcement, detection, prevention, investigation, containment, recovery, and automation.

Endpoint Deployment

Four Windows endpoints enrolled in Falcon with active sensor reporting and centralized host visibility.

Role-Based Policies

Separate domain-controller and workstation prevention policies with dedicated host groups and sensor-update management.

Detection & Prevention

Controlled PowerShell activity generated Falcon detections and confirmed active process prevention.

MITRE ATT&CK

Detection activity was mapped to Execution / User Execution with MITRE ATT&CK technique T1204.

Incident Response

CLIENTMACHINE was contained, isolated, restored, and verified online after containment was lifted.

Automation & SIEM

Falcon Next-Gen SIEM and Fusion SOAR were used for detection visibility, workflow automation, and response orchestration.

Protected Environment

The CrowdStrike sensor was deployed across multiple Windows roles so I could validate endpoint security across domain controllers, an administrative system, and a workstation.

                        CrowdStrike Falcon Cloud
                                  |
                 -------------------------------
                 |              |              |
            Endpoint        Next-Gen       Fusion SOAR
            Security          SIEM
                 |              |              |
                 +--------------+--------------+
                                |
                         Falcon Sensors
                                |
          ------------------------------------------------
          |                 |                |            |
        DC01              DC02          MANAGEMENT   CLIENTMACHINE
    172.16.10.10      172.16.10.11     172.16.30.10  172.16.20.101
   Server 2022        Server 2022       Server 2022     Windows 10
 Domain Controller   Domain Controller      Server       Workstation

CrowdStrike Falcon host management showing four enrolled Windows endpoints — Falcon Host Management showing the four enrolled Windows endpoints, platform details, local addressing, sensor version, and host grouping.

DEPLOYMENT

Asset Inventory & Endpoint Visibility

I verified that all protected systems appeared in Falcon Asset Inventory and that the platform correctly identified operating system, endpoint role, manufacturer, and host visibility.

CrowdStrike Falcon asset inventory showing the four Windows systems — Asset Inventory confirming CLIENTMACHINE, DC01, DC02, and MANAGEMENT as protected Windows assets.

CrowdStrike Falcon monitor deployment dashboard showing four Windows sensors — Deployment monitoring dashboard confirming four Windows sensors and centralized sensor coverage.

POLICY MANAGEMENT

Host Groups, Prevention Policies & Sensor Updates

I separated systems by role and applied different security controls instead of using a single policy for every endpoint.

SERVERS

DC01 and DC02 were placed into a dedicated static host group for domain-controller policy assignment.

WORKSTATIONS

CLIENTMACHINE and MANAGEMENT were grouped separately for workstation-focused prevention settings.

Sensor Lifecycle

A dedicated Windows sensor update policy was applied across all four endpoints with no pending hosts.

CrowdStrike Falcon host groups showing SERVERS and WORKSTATIONS — Static host groups used to organize endpoint roles.

CrowdStrike Falcon prevention policies for domain controllers and workstations — Separate enabled prevention policies for domain controllers and workstations.

CrowdStrike Falcon sensor update policy applied to four Windows hosts — Windows sensor update policy assigned across all four protected endpoints.

TELEMETRY

Falcon Event Visibility

I validated Falcon telemetry in the event-search interface and confirmed that the platform was receiving host metadata and policy-related events from the protected environment.

CrowdStrike Falcon event telemetry in Advanced Event Search — Falcon event data showing searchable metadata, policy settings, and platform fields.

CrowdStrike Next-Gen SIEM telemetry search — Next-Gen SIEM search view used to validate Falcon data and event ingestion.

DETECTION TESTING

Controlled PowerShell Detection

I generated controlled PowerShell activity on CLIENTMACHINE to validate how Falcon detected, classified, and responded to endpoint execution behavior.

Controlled PowerShell Activity
            |
            v
      Falcon Sensor
            |
            v
   Behavioral Detection
            |
            +------> Process Tree
            +------> Command Line
            +------> User / Host Context
            +------> MITRE ATT&CK Mapping
            |
            v
     Prevention Action
            |
            v
      Process Blocked

MITRE ATT&CK

Detection Classification & Investigation

Falcon mapped the controlled activity to the Execution tactic and User Execution technique, providing a standardized framework for understanding endpoint behavior.

Tactic

Execution

Technique

User Execution

Technique ID

T1204

CrowdStrike Falcon MITRE ATT&CK evaluation dashboard showing Execution and User Execution — MITRE ATT&CK evaluation dashboard showing CLIENTMACHINE detections mapped to Execution / User Execution.

CrowdStrike Falcon detection dashboard showing detection rate and attack mapping — Detection dashboard summarizing detection rate, severity-to-technique mapping, technique-to-tactic mapping, and attack classification.

MALWARE SCANNING

On-Demand Endpoint Scanning

I used Falcon's on-demand scanning capability to scan the protected Windows systems and review scan status, host completion, and file traversal statistics.

CrowdStrike Falcon on-demand malware scan across four endpoints — On-demand scan targeting all four endpoints. The captured run shows scan progress, host completion, and no suspicious files identified at that stage.

AUTOMATION

Fusion SOAR Workflows

I configured Falcon Fusion SOAR workflows to automate portions of detection handling and response.

High-Severity Workflow

Detection-triggered workflow designed to automatically update detection status for qualifying endpoint events.

Critical Detection Workflow

Detection-triggered automation used to add Falcon grouping tags and support consistent triage handling.

Automation Layer

Fusion SOAR connected detections to automated actions instead of relying entirely on manual analyst intervention.

CrowdStrike Falcon Fusion SOAR workflows enabled — Enabled Fusion SOAR workflows for high-severity and critical endpoint detection handling.

INCIDENT RESPONSE

Network Containment & Recovery

I validated Falcon's host-containment capability by isolating CLIENTMACHINE, confirming the endpoint was taken offline, then lifting containment and verifying recovery.

Detection / Investigation
          |
          v
   Contain Host
          |
          v
 CLIENTMACHINE Isolated
          |
          v
 Endpoint Shows Offline
          |
          v
   Lift Containment
          |
          v
 Connectivity Restored
          |
          v
   Host Status Normal

CrowdStrike Falcon CLIENTMACHINE contained and endpoint offline notification — CLIENTMACHINE successfully contained. The endpoint displayed a Falcon notification confirming it was offline.

CrowdStrike Falcon containment lifted and endpoint back online notification — Containment lifted successfully and the endpoint reported that it was back online.

Detection vs Prevention vs Response

One of the most important outcomes of the project was understanding the operational difference between identifying suspicious behavior, actively stopping it, and responding to the affected endpoint.

Detection

Falcon identified endpoint activity and surfaced host, user, process, command-line, and ATT&CK context.

Prevention

Falcon actively blocked the controlled PowerShell process instead of only logging the activity.

Response

I used host containment to isolate CLIENTMACHINE and later restored connectivity after investigation.

Final Results

By the end of the implementation and validation phase, the core CrowdStrike Falcon EDR workflow was operational.

4 Protected Endpoints

Two domain controllers, one management system, and one Windows workstation enrolled successfully.

Policy Enforcement

Role-based prevention and sensor-update policies applied with no pending assignments.

Process Blocking

Falcon prevention successfully denied controlled PowerShell execution.

MITRE Mapping

Detection activity mapped to Execution / User Execution (T1204).

Containment & Recovery

Endpoint isolation, containment removal, and restored connectivity were all validated.

SIEM & SOAR

Next-Gen SIEM telemetry and Fusion SOAR workflows were incorporated into the project.

Skills Demonstrated

CrowdStrike Falcon Falcon Insight Falcon Prevent Falcon Sensor Host Management Asset Inventory Prevention Policies Sensor Update Policies Endpoint Detection Endpoint Prevention Process Investigation MITRE ATT&CK Network Containment Incident Response Falcon Next-Gen SIEM Fusion SOAR PowerShell Windows Server Active Directory Security Testing Technical Documentation

CrowdStrike Falcon EDR Project

This case study documents the complete project workflow from sensor deployment and policy configuration through detection, prevention, investigation, SIEM visibility, SOAR automation, containment, and recovery.

Back to Projects