CrowdStrike Falcon EDR: How Falcon Insight Works and Who Should Run It
CrowdStrike Falcon EDR is the endpoint detection and response (EDR) part of the CrowdStrike Falcon platform, sold today as Falcon Insight XDR. A small program called the Falcon sensor runs on each computer, records what happens on it and sends that activity to the CrowdStrike cloud, where it is analyzed for signs of an attack. This guide explains what Falcon EDR records, how it detects and contains threats, how it differs from antivirus and a SIEM, and who should watch the alerts it raises. If you want the license tiers and prices instead, read our CrowdStrike pricing guide.
Get Protected
Endpoint Detectives runs 24/7 managed detection and response (MDR) on CrowdStrike Falcon for $150 per workstation per year, billed annually up front. No hidden fees.
What Is CrowdStrike Falcon EDR?
Falcon EDR is software that watches behavior on laptops, desktops and servers and lets a responder act on a machine from anywhere. CrowdStrike says Falcon Insight XDR unifies endpoint detection and response (EDR) with identity, cloud and mobile telemetry to stop breaches.
The category itself is not new. According to CrowdStrike, the term EDR was coined by Gartner analyst Anton Chuvakin. What sets Falcon apart is that the heavy lifting happens in the cloud, so the agent on each device stays small and the data from every device sits in one console.
Falcon EDR has three jobs:
- Record. Capture what programs, users and network connections do on each device.
- Detect. Flag sequences of behavior that look like an attack.
- Respond. Give a responder tools to isolate the device and clean it up.
What Does the Falcon Sensor Record?
The Falcon sensor works like a flight recorder for each computer. CrowdStrike says its EDR tracks hundreds of security-related events, such as process creation, drivers loading, registry modifications, disk access, memory access and network connections.
That record matters after something slips through. An analyst can replay what happened, see which account ran which command and find every other machine that touched the same file or address. CrowdStrike says Falcon Insight lets users write custom searches going back up to 90 days, with query results returned in five seconds or less.
For a business owner, the practical point is simple. When something goes wrong, there is a timeline to work from instead of a guess.
How Does Falcon EDR Detect Attacks?
Falcon EDR looks at behavior, not just known bad files. CrowdStrike says effective EDR looks for indicators of attack (IOAs), a behavioral approach, rather than relying only on signatures or indicators of compromise (IOCs).
This is the main reason EDR replaced plain antivirus for businesses. The CrowdStrike 2026 Global Threat Report found 82% of detections were malware-free. In those attacks, there is no malicious file to match. The attacker logs in with stolen credentials and uses normal admin tools, and only the pattern of behavior gives them away.
Speed is the other reason. The CrowdStrike 2026 Global Threat Report found average eCrime breakout time fell to 29 minutes, and the fastest observed breakout was 27 seconds. Breakout time is how long an attacker needs to move from the first machine to others on the network.
| Antivirus | Falcon EDR | |
|---|---|---|
| What it looks for | Known malicious files | Suspicious behavior (IOAs) |
| Catches attacks with stolen logins | Rarely | Yes, by behavior |
| History you can search | Little or none | Device activity timeline |
| Can isolate a device remotely | No | Yes |
How Does Falcon EDR Contain a Threat?
Falcon EDR can cut a computer off from the network with one action, which stops an attacker from spreading. CrowdStrike says Falcon network containment isolates a host from all network activity while it can still talk to the CrowdStrike cloud, and the containment persists through reboots.
After containment, the responder cleans up. CrowdStrike says Falcon EDR includes Real Time Response (RTR), which gives responders direct system access to remediate threats from anywhere. With RTR, an analyst can stop processes, remove files and collect evidence without driving to your office.
Exploited software is a common way in, so containment and patching work together. The Verizon 2026 DBIR found exploitation of vulnerabilities was the top initial access vector at 31% of breaches, and credential abuse accounted for 13%. Our vulnerability scanning services find the gaps before attackers do.
Is CrowdStrike Falcon an EDR or a SIEM?
Falcon Insight is an EDR. A SIEM, short for security information and event management, is a different tool that gathers logs from many systems such as firewalls, servers and cloud apps, then correlates them in one place.
The two overlap at the edges. CrowdStrike says Falcon Insight XDR includes 10GB per day of free third-party data ingest in the same console. Still, EDR is built around deep visibility on each device, and a SIEM is built around broad visibility across many log sources. Our guide to what SIEM is explains the difference in more detail.
Is CrowdStrike Falcon EDR or MDR?
Falcon EDR is a tool. MDR is a service where trained people use that tool for you around the clock. Falcon can raise a high-quality alert at 3 a.m., but someone still has to read it, decide whether it is real and press the button to contain the device.
That is the gap Endpoint Detectives fills. Every Endpoint Detectives subscription includes the CrowdStrike EDR license, endpoint monitoring, network monitoring, cloud monitoring, vulnerability scanning, SIEM log aggregation, a 24/7 SOC and remote incident response. SOC means security operations center, the team that watches alerts. Endpoint Detectives analysts can respond to a confirmed threat in as little as 15 minutes.
The closest comparable MDR provider costs about twice as much as Endpoint Detectives. Read what MDR is for a full explanation, or see our managed EDR service page.
Get Protected
Get Falcon EDR plus the people who watch it, for one price per workstation.
How Do Oklahoma Businesses Get Falcon EDR Running?
Getting Falcon EDR running is a short project for a typical office, because there is no server to install. Endpoint Detectives customers deploy the CrowdStrike agent themselves with an easy-to-follow guide, and monitoring starts as each device checks in.
Follow these steps:
- List every device. Include laptops that leave the office and any server or virtual machine.
- Install the sensor. Use the deployment guide on each Windows, macOS or Linux device.
- Confirm coverage. Check the console shows every device on your list.
- Set response rules. Decide which actions analysts can take without calling you first.
- Write down who to call. Pair the tool with an incident response plan.
Oklahoma law gives one more reason to document this. SB 626 defines reasonable safeguards as policies and practices that protect personal information appropriate to the size of the entity, including risk assessments, technical and physical layered defenses, employee training and an incident response plan. EDR with 24/7 monitoring is one of those layered defenses. Endpoint Detectives is a CrowdStrike partner headquartered at 720 NE 63rd St in Oklahoma City and serves businesses nationwide, including our Oklahoma City cybersecurity and Tulsa cybersecurity clients.
FAQ
What is the purpose of the CrowdStrike Falcon sensor?
The Falcon sensor is the small agent on each device. It records security events, blocks known threats and sends activity to the CrowdStrike cloud so attacks can be detected and contained.
Is CrowdStrike Falcon an EDR?
Yes. Falcon Insight XDR is CrowdStrike's EDR product. It also pulls in identity, cloud and mobile data, which is why CrowdStrike calls it XDR.
Is CrowdStrike an EDR or a SIEM?
CrowdStrike Falcon Insight is an EDR. CrowdStrike sells SIEM products separately. A SIEM collects logs from many systems, while EDR focuses on deep activity on each device.
What is CrowdStrike Falcon Insight?
Falcon Insight is the name of the EDR module in the Falcon platform. It records device activity, detects attacks by behavior and gives responders tools to contain and fix them.
Conclusion
CrowdStrike Falcon EDR gives a business a detailed record of every device, behavior-based detection and one-click containment. The tool is strong, but it only protects you if someone watches it every hour of every day. For Oklahoma businesses without a security team, pairing Falcon with MDR is the practical way to get both.
Related Guides
Get Protected
Endpoint Detectives delivers 24/7 MDR on CrowdStrike Falcon for $150 per workstation per year, billed annually up front. No hidden fees. Talk to us about protecting your team.
Born in Oklahoma. Hunting threats everywhere. Real humans. Real response. No corporate runaround. No hidden fees. No mercy for threats.
Last updated: October 28, 2026