Offered Monday, Sept. 15 and Thursday, Sept. 18
Additional registration required ($900 per course by Aug. 15; or use existing training credits)
Trainings will be held at the Park MGM
Enhance the impact of your Fal.Con experience with full-day, deep-dive CrowdStrike University training courses led by our experts. Designed for practitioners and power users, these sessions go beyond the surface — delivering real-world skills, technical mastery, and the kind of battle-tested knowledge your team can put to work immediately.
Mix and match your CrowdStrike University courses from the list below. Add a course to your registration today and secure your spot in one of the most popular experiences at Fal.Con.
New user of the CrowdStrike Falcon® platform? This course is for you. Learn the technical fundamentals like installation, configuration, and management of the platform. Intended for those who will administer the platform daily, learn how to install sensors and configure prevention policies, users, and groups, and fine-tune detections.
Course availability: Monday, Sept. 15 and/or Thursday, Sept. 18 | 9 a.m.-5 p.m.
Learn how to use CrowdStrike’s cloud security posture management (CSPM) module, CrowdStrike Falcon® Horizon, to secure your cloud environment configurations and remain in compliance with industry standards. Find out how CSPM can help you determine if your cloud assets are misconfigured, if you’re meeting your industry standards for security, and if any behaviors affecting your cloud assets are malicious. During this course, you’ll locate cloud accounts with vulnerabilities, find the steps to remediate, and learn where to communicate those findings.
Course availability: Monday, Sept. 15 | 9 a.m.-5 p.m.
Learn how to use CrowdStrike Falcon® Cloud Security and “shift left” to protect containerized workloads and cloud-native applications. This course includes security best practices and tips for using Falcon Cloud Security to mitigate common threats to cloud workloads, how to proactively identify common threats, and how to mitigate risks at every stage of application development.
Course availability: Thursday, Sept. 18 | 9 a.m.-5 p.m.
Learn how to configure, implement, and utilize CrowdStrike Falcon® Identity Protection’s (IDP) data feeds to secure your organization against credential-based attacks, including the basic tenets of identity-based attacks, Zero Trust, and identity protection. Learn how Falcon IDP can help you gain visibility into your overall security posture, implement policy rules to enforce targeted controls against users and groups in your domain, and how to threat hunting, analysis, and light investigation from identity-based detections.
Course availability: Monday, Sept. 15 and/or Thursday, Sept. 18 | 9 a.m.-5 p.m.
This course instructs learners on best practices for using CrowdStrike Falcon® Insight. This course provides the knowledge and skills necessary for incident responders or security analysts who use the Falcon platform to detect, investigate, and respond to incidents. During this course, learners will analyze real-world scenarios for detections and incidents using a standard analytical process.
Course availability: Monday, Sept. 15 and/or Thursday, Sept. 18 | 9 a.m.-5 p.m.
Learn best practices for using CrowdStrike Falcon® Insight to detect, investigate, and respond to security incidents. Designed for incident responders and security analysts, this course builds the skills you need to navigate the Falcon platform with confidence. You'll work through real-world scenarios using a standard analytical process to turn detections into decisive action.
Course availability: Monday, Sept. 15 and/or Thursday, Sept. 18 | 9 a.m.-5 p.m.
This hands-on course is intended for technical contributors performing remediation, host-level response to detections, or host investigations using CrowdStrike Falcon® Real Time Response (RTR). You’ll explore use cases and administrative considerations for Falcon RTR, while gaining practical experience remediating threats using RTR commands, custom scripts, and via the API using PS Falcon.
Course availability: Monday, Sept. 15 and/or Thursday, Sept. 18 | 9 a.m.-5 p.m.
Designed for SOC analysts, SIEM analysts, threat hunters, and incident responders, this course teaches you how to use CrowdStrike Query Language (CQL) to investigate events with speed and precision. Learn event structure fundamentals, basic query syntax, query writing techniques, and strategies for optimizing query performance.
Course availability: Monday, Sept. 15 and/or Thursday, Sept. 18 | 9 a.m.-5 p.m.
In this hands-on course, learn how to prepare, analyze, and act on log data using CrowdStrike Falcon® LogScale. Discover how to optimize search performance, build powerful visualizations with LogScale Query Language, run statistical analyses, and create alerts and automated actions to accelerate your response.
Course availability: Monday, Sept. 15 and/or Thursday, Sept. 18 | 9 a.m.-5 p.m.
Designed for data analysts, IT administrators, and log management specialists, this hands-on course teaches you how to extract value from structured and unstructured data using CrowdStrike Falcon® LogScale™. Learn how to use CrowdStrike Query Language (CQL) and regular expressions to uncover valuable insights, prepare data for visualization, build impactful dashboards, and apply a systematic workflow for processing new data sources.
Course availability: Monday, Sept. 15 and/or Thursday, Sept. 18 | 9 a.m.-5 p.m.
Designed for SOC analysts, SIEM analysts, threat hunters, and incident responders, this course teaches you how to use CrowdStrike Query Language (CQL) to investigate events with speed and precision. Learn event structure fundamentals, basic query syntax, query writing techniques, and strategies for optimizing query performance.
Course availability: Monday, Sept. 15 and/or Thursday, Sept. 18 | 9 a.m.-5 p.m.
Get hands-on with CrowdStrike Falcon® Next-Gen SIEM in this course designed for system administrators, SIEM administrators, and security tools administrators. Configure role-based access and manage user/role permissions to establish secure administrative control and explore operational best practices, fleet management, and log collector configuration.
Course availability: Monday, Sept. 15 and/or Thursday, Sept. 18 | 9 a.m.-5 p.m.
Designed for system administrators, security engineers, data custodians, and data managers, this course teaches you how to onboard and manage data sources in CrowdStrike Falcon® Next-Gen SIEM. Explore techniques for data source integration, connection management, and data normalization. Through hands-on exercises, you will onboard various data types using data connectors, implement proper data parsing using CrowdStrike Parsing Standard (CPS), and ensure reliable data flow. Learn critical aspects of managing the data pipeline, from initial connection setup to ongoing maintenance and troubleshooting.
Course availability: Monday, Sept. 15 and/or Thursday, Sept. 18 | 9 a.m.-5 p.m.
Get hands-on with CrowdStrike Falcon® Next-Gen SIEM in this advanced course designed for security leads, analysts, hunters, and operations specialists. Learn to investigate third-party data, correlate events for deeper context, and leverage CrowdStrike Falcon® Fusion SOAR automations to streamline detection and response. Build skills in continuous monitoring, advanced threat detection, and proactive threat hunting — all through intuitive dashboards that increase precision and speed response.
Course availability: Monday, Sept. 15 and/or Thursday, Sept. 18 | 9 a.m.-5 p.m.
Designed for SOC analysts, SIEM analysts, threat hunters, and incident responders, this course teaches you how to use CrowdStrike Query Language (CQL) to investigate events with speed and precision. Learn event structure fundamentals, basic query syntax, query writing techniques, and strategies for optimizing query performance.
Course availability: Monday, Sept. 15 and/or Thursday, Sept. 18 | 9 a.m.-5 p.m.
For more information and details on the CrowdStrike University program, visit the Trainings and Certifications website.
