CrowdStrike Falcon X Recon FAQ

Falcon X Recon provides organizations the ability to more fully understand their digital presence. This enables them to identify risks such as compromised or leaked data, threats to personnel or facilities, and compromise of third parties or acquisition targets. Falcon X Recon does this by collecting and monitoring activity from millions of restricted web pages, criminal forums, marketplaces, messaging applications and more. Easy-use-wizards enable users to create monitoring rules and be alerted when a potential threat targets their brand, employees and sensitive data.

The dark web is thought of as a hotbed of criminal activity, where you can buy credit card numbers, drugs, counterfeit goods, login credentials, malware, even find a hacker for hire. The dark web is designed to be hidden and special browsers, such as Tor, are required to access these sites. However, on-line threats aren’t just limited to the dark web.

The deep web also contains areas of the internet that aren’t indexed, which means search engines won’t return the contents of these pages as results. Much of the deep web includes parts of the legitimate, mainstream web (like Netflix or Amazon pages), simply because they are restricted to customers and personalized for users.

In addition to the deep, dark web, threats can hide in plain sight on the regular internet, you just need to know where to look (e.g. Reddit, Twitter, GitHub, paste sites). They can also be found in messaging apps (Telegram, QQ, etc) or fake mobile app stores, IRC channels, and much, much more.

Falcon X Recon is constantly scanning and pulling data from the deep, dark web and other sources. The data collection is both broad and deep. Falcon X Recon accesses data from over one million unique data sources and this number is constantly growing. Here are some example sources:

The information is constantly collected in real time, giving security teams the ability to “shoulder surf” an adversary or attacker. This ensures that the information displayed is always the most current and relevant. This is in contrast to EDR solutions that need to query endpoints, which results in information that is only as good as the last query or scan performed.

There are two editions of Falcon X Recon Express and Enterprise. The Express version is designed for SMB or mid market organizations who are primarily interested in brand monitoring and executive protection. The Enterprise edition provides additional search capabilities, BIN data and includes the CrowdStrike actor profiles and real-time indicator feed.

Falcon X Recon Enterprise is designed to be sold as a standalone module. While CrowdStrike Falcon modules are recommended and proven to stop breaches, they are not a requirement.

For customers with both Falcon X Recon Enterprise and CrowdStrike Falcon, the Universal Search feature returns from all licensed Falcon modules. This is incredibly powerful enabling users to pivot into related assets, detections, intelligence reports, IOCs and actor profiles to gain additional context for the investigation.

The Express version is designed exclusively for CrowdStrike Falcon SMB or mid-market customers with a primary interest in brand monitoring and executive protection.

Customers do not need to deploy any infrastructure for Falcon X Recon. Falcon X Recon uses the Falcon Platform, which is built on 100 percent cloud architecture. This allows customers to be protected faster and drives down total cost of ownership (TCO) by eliminating on-premises hardware acquisition, deployment and maintenance.

Falcon X Recon Express is licensed on a subscription basis by endpoint. Falcon X Recon Enterprise can also be licensed by company size.

For more information please contact us or request a quote.