In short
CrowdStrike Falcon Insight XDR is CrowdStrike's endpoint detection and response (EDR), unified with identity, cloud and mobile telemetry. It detects attacker behaviour using AI and threat intelligence, maps activity to MITRE ATT&CK, speeds investigation with Charlotte AI and lets analysts respond through Real Time Response and Falcon Fusion SOAR workflows, all from one lightweight Falcon sensor.
Get a quote for CrowdStrike Falcon Insight XDR
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What Falcon Insight XDR is
CrowdStrike sells its endpoint security as modules on one platform. Falcon Prevent is the next-generation antivirus that stops malware before it runs. Falcon Insight XDR is the module that watches what happens after that: it is CrowdStrike's endpoint detection and response (EDR), which CrowdStrike describes as unifying EDR with identity, cloud and mobile telemetry to stop breaches.
You will see it searched for as "Falcon Insight", "Falcon Insight EDR" and "Falcon Insight XDR". They refer to the same capability: CrowdStrike now presents its EDR under the Insight XDR name, because the console can bring signals from other Falcon modules and third-party tools into the same investigation.
Insight XDR uses the same lightweight Falcon sensor as the rest of the platform, on Windows, macOS and Linux, managed from the cloud-based Falcon console. Turning on detection and response is a licence and policy change rather than a second agent. For the wider platform, including prevention, identity protection and SIEM, see CrowdStrike Falcon on our Cloud Security site.
How Falcon Insight XDR detects attacks
Many attacks no longer drop an obvious piece of malware. An attacker signs in with a stolen password, runs tools already on the machine and moves from device to device. Insight XDR is designed to catch that kind of activity:
- Behaviour, not just files: the sensor records process, file, network and logon activity, and CrowdStrike analyses it for indicators of attack, the patterns of what an attacker is trying to do.
- Threat intelligence: CrowdStrike enriches detections with its own adversary intelligence, so an alert can carry context about the techniques and the likely intent behind them.
- MITRE ATT&CK mapping: detections are mapped to the MITRE ATT&CK framework, which gives analysts a shared language for what stage an attack has reached.
- Attack path visibility: related events are linked so an analyst can see how an intrusion started and what it touched.
- AI-assisted investigation: CrowdStrike describes automated leads powered by CrowdStrike Signal and Charlotte AI, which help prioritise threats and summarise what happened.
The aim is fewer, richer alerts. Even so, EDR only helps if someone looks at what it finds. If that is a gap for you, read on to the managed options below, or our guide to threat hunting.
Response tools: Real Time Response and Falcon Fusion SOAR
Detection is half the job. Insight XDR gives your team, or a managed service acting for you, the tools to contain and clean up:
| Tool | What it does | Why it matters |
|---|---|---|
| Real Time Response (RTR) | Direct, remote access to an affected system from the Falcon console | Investigate and remediate without visiting the device or waiting for it to come back to the office |
| Falcon Fusion SOAR | Native security orchestration, automation and response workflows | Automates repetitive steps, such as enriching an alert or notifying the right people, so response is consistent |
| Incident visualisation | Shared, real-time view of an incident across the devices and identities involved | Lets several people work the same incident without losing track |
| Charlotte AI | AI-assisted triage and investigation | Turns raw telemetry into a summary that a smaller team can act on |
How far automated response should go is a policy decision. Most organisations start cautiously on servers and line-of-business systems, then automate more once they trust the detections. Our EDR deployment guide covers that in steps.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Beyond the endpoint: what makes it XDR
XDR means correlating signals from more than one place. With Insight XDR, CrowdStrike says you can extend investigations with context from its identity, cloud, mobile and data protection modules, and bring in third-party data in the same console.
In practice that means:
- a suspicious sign-in flagged by Falcon identity protection can sit in the same incident as the process it launched on a laptop
- Falcon for Mobile brings detections from iOS and Android into the same console; it is built on Insight XDR and monitors designated corporate apps rather than personal content
- cloud workload detections and endpoint detections can be investigated together
- logs from other security tools can be searched alongside Falcon telemetry, with Falcon Next-Gen SIEM available for wider log management
Whether you need those extra sources depends on your estate. Many small and mid-sized organisations get most of the value from endpoint detection plus someone watching it. Our extended detection and response guide explains the trade-offs, and mobile EDR covers the phone side.
Falcon Prevent, Insight XDR, OverWatch and Falcon Complete compared
CrowdStrike's names can be confusing. This is how the main detection and response pieces fit together:
| Component | What it is | Who acts on it |
|---|---|---|
| Falcon Prevent | Next-generation antivirus: stops malware, ransomware and fileless techniques before they run | Automatic |
| Falcon Insight XDR | EDR and XDR: records activity, detects attacker behaviour, gives investigation and response tools | Your team, or a managed service |
| Adversary OverWatch | CrowdStrike's managed threat hunting: its hunters look for hands-on-keyboard intrusions and tell you what they find | CrowdStrike hunts, your team responds |
| Falcon Complete Next-Gen MDR | CrowdStrike's 24/7 managed detection and response, with hands-on remediation | CrowdStrike's team responds for you |
For a deeper look at the managed service, see Falcon Complete on our Cloud Security site. If you would rather keep Falcon Insight and have a different provider watch it, WatchGuard's Open MDR can monitor CrowdStrike EDR using your own Falcon Insight licence.
Is CrowdStrike Falcon Insight XDR the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How we supply CrowdStrike Falcon
Forever Systems supplies CrowdStrike through the bundles CrowdStrike makes available to managed service providers, which is why the names differ from the Falcon Go, Pro and Enterprise bundles on CrowdStrike's own online store:
| Bundle | What it includes |
|---|---|
| Falcon Defend | Falcon Prevent next-gen antivirus, Falcon Device Control, Falcon Firewall Management and Threat Graph cloud analytics |
| Falcon Advanced Defend | Everything in Defend, plus Adversary OverWatch managed threat hunting and the Falcon Data Replicator event feed |
| Falcon Complete Defend | Everything in Advanced Defend, plus Falcon Discover and Falcon Complete Next-Gen MDR |
Falcon Insight XDR is not listed as a component of these bundles. In practice that leaves two routes to detection and response through us: Complete Defend, where CrowdStrike's own Falcon Complete team detects, investigates and remediates for you, or Advanced Defend, where Adversary OverWatch hunts and alerts you and your team responds. If you specifically want Insight XDR licences so your own team can investigate, tell us and we will check what is available at quote.
Add-ons such as Falcon Discover, Falcon Spotlight vulnerability assessment, Falcon Identity Threat Protection, Falcon Data Protection, Falcon for Mobile, Falcon Next-Gen SIEM and Falcon Guardian sit on top. Which bundle and add-ons fit is confirmed at quote, once we know your devices and who will act on alerts. Bundle detail and licensing are on our CrowdStrike pricing page.
Antivirus-only buyers comparing Falcon Go or Pro should see endpointprotection.uk.
Who Falcon Insight XDR suits
Falcon Insight XDR fits organisations that want an established cloud EDR on one lightweight sensor:
- businesses replacing traditional antivirus because an insurer, auditor or customer has asked about detection and response
- mixed Windows, macOS and Linux estates managed from one cloud console
- IT teams that want strong investigation tools and plan to add managed hunting or MDR
- organisations already using other Falcon modules who want identity, cloud and mobile detections in the same place
Comparing it with other platforms? Our best EDR solutions guide sets out the questions to ask, and our Cloud Security site compares CrowdStrike vs SentinelOne vs Defender.
How Forever Systems helps
We can help you decide whether Falcon is the right platform, and whether you need Insight XDR for your own team or would rather hand detection and response to Falcon Complete, choose the bundle and add-ons, roll out the sensor and remove the product it replaces, and agree with you how alerts are handled, whether by your team, by CrowdStrike's own services or by an MDR service. Licence changes and renewals then sit on one Forever Systems account.
Contact us to talk about CrowdStrike Falcon Insight XDR for your organisation.
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos and Check Point Harmony
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
What is CrowdStrike Falcon Insight?
Falcon Insight is CrowdStrike's endpoint detection and response module, now presented as Falcon Insight XDR. It records activity on each device through the Falcon sensor, detects attacker behaviour, maps it to MITRE ATT&CK and gives analysts investigation and response tools, extended with identity, cloud and mobile telemetry.
Is Falcon Insight EDR or XDR?
Both. Its core is EDR on workstations and servers. CrowdStrike calls it Insight XDR because it can bring in context from its identity, cloud, mobile and data protection modules and from third-party data, so related signals are investigated together.
What is CrowdStrike Real Time Response?
Real Time Response gives analysts direct remote access to an affected system from the Falcon console, so they can investigate and remediate without touching the device. It is part of the response toolset in Falcon Insight XDR.
Does Falcon Insight XDR include threat hunting?
Insight XDR gives you the data and tools to hunt yourself. CrowdStrike's managed threat hunting is Adversary OverWatch, included in the Falcon Advanced Defend and Complete Defend bundles we supply. Falcon Complete Next-Gen MDR adds 24/7 response by CrowdStrike's team.
Can I buy Falcon Insight XDR from Forever Systems?
We supply CrowdStrike through its Falcon Defend, Advanced Defend and Complete Defend bundles for managed service providers, and Insight XDR is not listed as a component of those bundles. Complete Defend gives you detection and response run by CrowdStrike's Falcon Complete team. If you want Insight XDR for your own team, ask us and we will check the options at quote.
How much does CrowdStrike Falcon Insight XDR cost?
It depends on the Falcon bundle, add-ons and number of endpoints. We do not publish prices: ask us for a quote and we will confirm which Falcon bundle fits.
Still have a question about CrowdStrike Falcon Insight XDR?
Ask us and a member of our team will reply by email.
More endpoint security guides
Vigilance MDRSentinelOne's managed detection and response service, now Wayfinder MDR, explained.
WatchGuard EPDRWatchGuard EPDR is now Endpoint Security 360: the renamed editions, features and modules.WatchGuard MDRWatchGuard's 24/7 MDR service: Core MDR, Core MDR for Microsoft, Total MDR and Open MDR compared.
GravityZone XDRBitdefender's EDR plus native XDR sensors for identity, Microsoft 365, network, cloud and business apps.Bitdefender MDRBitdefender's managed detection and response on GravityZone: what its SOC does and what you agree up front.