The combined analytical powers of ArcSight Intelligence's Behavioral Analytics with the rich Falcon sensor data from CrowdStrike enables visibility of hard-to-find threats inside your organization. And, it couldn't be easier to get started. Simply log in, head over the CrowdStrike App Store, and click on the ArcSight Intelligence Application. Once you click the "Try it free" button, ArcSight Intelligence automatically gains access to your Falcon sensor data. There's no software to deploy, no machines to manage - everything happens on your behalf in the cloud. After 30 days of data collection, ArcSight Intelligence's machine learning engine has all it needs to begin detecting insider threats and anomalous activities in your CrowdStrike data, which may be threatening your organization. You are then provided with access to ArcSight Intelligence's state-of-the-art threat hunting user interface that highlights instances of risky anomalous behaviors and prioritized lists of the riskiest entities in your organization. If you are worried you won't have the time or staff to monitor ArcSight Intelligence's insights - don't worry! ArcSight Intelligence offers an optional add-on threat hunting service comprised of a team of security professionals who provide ongoing threat hunting on a weekly, bi-weekly, or daily schedule. In addition, ArcSight Intelligence's extensible API enables your team to orchestrate event notifications to your existing "pane of glass", ticketing systems and even your SOAR platform.
Micro Focus ArcSight Intelligence allows your security team to see CrowdStrike Falcon's detailed and accurate endpoint data using behavioral intelligence to detect threats or actors that may be hiding in your enterprise. By shining a new light on user information - abnormal login frequency, date or time of work, unusual machines - ArcSight Intelligence adds valuable context to help you see threats that you might otherwise miss. With the right user context, you can detect unusual login patterns, sudden or unusual file or system activity, user impersonation, internal recon, or low and slow attacks. Once identified, threat leads can be passed on to your security team or the CrowdStrike OverWatch service for further investigation.
