CrowdStrike University

Develop the art of crafting intelligent AI security policies that empower your workforce while protecting your organization from emerging AI-related risks. In this hands-on course, you'll design and implement comprehensive Falcon AI Detection and Response (AIDR) policies that automatically identify and prevent risky behaviors, from inadvertent PII exposure in AI chat interfaces to unauthorized shadow AI usage. Through real-world sandbox scenarios, you'll build sophisticated monitoring policies, configure smart detectors for sensitive data and malicious prompts, and create custom rules tailored to your organization's unique needs. Walk away with the expertise to architect security policies that strike the perfect balance between enabling productive AI adoption and safeguarding against data leakage, compliance violations, and AI-powered threats.

Course availability: Monday, 2 Nov. | 13:00 – 17:00

View syllabus →

Designed for SOC analysts, SIEM analysts, threat hunters, and incident responders, this course teaches you how to use CrowdStrike Query Language (CQL) to investigate events with speed and precision. Learn event structure fundamentals, basic query syntax, query writing techniques, and strategies for optimizing query performance.

Course availability: Monday, 2 Nov. | 9:00 – 17:00

View syllabus →

Learn to design and implement security orchestration workflows using Falcon Fusion SOAR to enhance incident response and security operations efficiency. This course provides practical skills to create workflow architectures incorporating triggers, conditions, and actions. Participants will explore intelligent triage workflows for alert classification and prioritization, develop multi-stage response orchestrations that coordinate actions across security systems, and learn automated remediation techniques for containment, eradication, and recovery processes. Through hands-on labs and real-world scenarios, students will gain experience with testing methodologies, debugging techniques, and observability practices essential for maintaining workflow reliability in enterprise security environments.

Course availability: Monday, 2 Nov. | 9:00 – 17:00

View syllabus →