Prevention and EDR are the foundation. Add expert hunting with Advanced Defend, or managed detection and response with Complete Defend.
Falcon Prevent and Falcon Insight EDR.
OverWatch hunting, device control, and firewall management.
A team to monitor, investigate, and respond around the clock.
Select a level to explore its capabilities.
Three clear options. Choose the capabilities and response coverage your business needs.
A foundation of next generation antivirus and endpoint visibility.
Extend your endpoint defenses with expert threat hunting and additional controls.
Combine endpoint technology with around the clock managed response.
Choose your endpoint quantity in Stripe. Taxes, eligibility, terms, and the final amount are confirmed at checkout. View terms.
Defend combines Falcon Prevent with Falcon Insight EDR. You get both prevention and the visibility needed to investigate, while your team remains responsible for operating the response process.
Falcon Prevent helps block malicious files and behavior. Falcon Insight adds endpoint activity and detection context, allowing administrators to review suspicious events, understand related actions, and use available response tools.
An organization with staff or an IT provider available to review detections, investigate suspicious activity, and decide when to take action.
Next generation antivirus and prevention technologies designed to address malicious files and suspicious behavior.
Security telemetry and detection context to investigate activity across supported endpoints.
Contain and investigate affected devices using the platform’s supported response capabilities.
Manage endpoint protection through a shared cloud platform and agent deployment model.
Advanced Defend adds Falcon OverWatch threat hunting to the Defend foundation. Hunters look for activity that warrants investigation; a hunting service is different from a fully managed remediation service.
Attackers may use legitimate tools and stolen credentials in ways that do not look like a simple malware file. Proactive hunting adds human analysis to endpoint data, helping surface suspicious patterns and findings for your team to investigate.
A business that can act on security findings but wants additional expert hunting to help uncover suspicious activity beyond automated detections.
Expert led proactive hunting to help identify intrusions and malicious activity that may otherwise be overlooked.
Keep the prevention and EDR foundation from Falcon Defend.
Add visibility and policy controls for USB usage on supported systems.
Manage supported endpoint firewall policy as part of ECC’s Advanced Defend offering.
Complete Defend brings Falcon Complete managed detection and response into the bundle. The step up is operational ownership: a managed team monitors, investigates, and takes response actions within the service scope.
Rather than relying on your staff to interpret every detection, Falcon Complete combines the endpoint technology with managed monitoring, triage, investigation, and remediation. Your business still participates in onboarding, escalation contacts, and decisions outside the provider’s authorized scope.
An organization that wants to reduce the day to day burden of monitoring and response, especially when it has limited internal security staffing.
A managed team supports monitoring, investigation, and response around the clock.
Authorized actions to contain threats and support remediation on covered endpoints.
Falcon prevention and EDR remain the technical foundation of the service.
Device control, firewall management, and Falcon Discover inventory are part of the Complete Defend offering listed here.
Expand a capability for its meaning. Compare the tools and the people behind each option.
| Capability | Falcon Defend | Advanced Defend | Complete Defend |
|---|---|---|---|
Falcon PreventNext generation antivirus and behavioral prevention. | Included | Included | Included |
Falcon Insight EDREndpoint activity, detection context, and tools for investigation. | Included | Included | Included |
Endpoint response toolsUse the platform to contain and investigate supported endpoints. | Included | Included | Included |
Proactive human threat huntingLook for potential intrusions and suspicious behavior beyond automated detections. | Not included | Falcon OverWatch | Managed service coverage |
USB device controlManage and review USB usage on supported endpoints. | Not included | Included | Included |
Firewall managementManage supported host firewall policies through the platform. | Not included | Included | Included |
System and account inventoryFalcon Discover helps surface systems, applications, and account usage. | Not included | Not included | Included in ECC bundle |
Managed detection triageA managed team reviews and investigates detections within the service scope. | Your team | Your team, with hunting support | Falcon Complete |
Managed response and remediationAn operational response service that can act on confirmed threats. | Your team | Your team | Falcon Complete |
24/7 managed response coverageAround the clock monitoring and response through the managed service. | Not included | Hunting coverage | Included |
This table describes the ECC bundles offered here. Platform wide identity, cloud, SIEM, and other modules are not automatically part of every endpoint bundle. Platform compatibility, permissions, retention, and licensing affect available features.
Endpoint prevention, visibility, and response tools delivered through the Falcon platform.
CrowdStrike Falcon brings endpoint protection and endpoint detection and response together in a cloud managed platform. The agent gathers security activity from devices so administrators can investigate suspicious behavior and understand how an incident developed.
Falcon Defend provides the prevention and EDR foundation. Advanced Defend adds Falcon OverWatch proactive threat hunting, while Complete Defend brings in Falcon Complete managed detection and response. The choice depends on how much investigation and response work your own team can take on.
Falcon Prevent uses prevention technologies to help detect and block malicious files and behavior, including attacks that may evade older signature based approaches.
Falcon Insight EDR captures endpoint activity to help explain a detection, follow an attack’s progression, and support an investigation.
Response tools and operational ownership need to work together. Advanced hunting and managed response provide different kinds of human support.
Endpoint protection, threat hunting, and managed response solve different needs. We can help you compare the options before you purchase.
Talk through your optionsCompare the level of protection and management your business needs.
Purchase using ECC’s existing Stripe payment links.
We’ll coordinate account setup and the next steps for deployment.
Falcon Defend combines prevention and EDR. Advanced Defend adds proactive threat hunting and controls. Complete Defend includes managed detection and response.
No. Threat hunting looks for suspicious activity and potential intrusions. Managed detection and response adds an operational response service within the provider’s scope.
We will coordinate onboarding and account setup. Deployment requirements and platform compatibility depend on your environment and the selected plan.
Yes. The ECC Falcon Defend bundle includes Falcon Prevent and Falcon Insight endpoint detection and response. The base plan already combines prevention with investigation visibility.
Advanced Defend adds proactive Falcon OverWatch hunting. Complete Defend adds managed monitoring, investigation, and response through Falcon Complete. Hunting helps surface threats; managed response adds an operational team to help act on them.
Your team or your service provider needs a process to evaluate and act on hunting findings. OverWatch hunting should not be treated as the same service as Falcon Complete managed remediation.
No. Falcon is a broader platform, but this page describes the endpoint bundles ECC offers. Additional identity, cloud, SIEM, or other capabilities require confirmation of the selected license and scope.
Yes. Your organization still manages its business systems, user access, backups, and activities outside the MDR service scope. Falcon Complete supports the security monitoring and response operation for covered endpoints.
It provides inventory and visibility into systems, applications, and account usage, helping your team better understand the environment alongside endpoint protection and managed response.
Tell us what you’re working through. We’ll help you find the right next step.
