CrowdStrike Solutions

PROTECTING LINUX WITH

THE FALCON PLATFORM
Falcon unifies the technologies required to protect
workloads across all environments

ONE PLATFORM FOR KEY BENEFITS

ALL LINUX WORKLOADS Provides integrated container protection

Linux is one of the primary operating systems for a majority of Defends Linux hosts and containers against active
business-critical applications, making Linux servers a frequent attacks
attack target. Since Linux servers can be found on-premises or
in private or public clouds, protecting them requires a solution Enables end-to-end visibility with endpoint detection
that provides runtime protection and visibility for all Linux hosts, and response (EDR) for Linux and containers
regardless of location.
Reduces complexity by providing consistent
The CrowdStrike Falcon® platform simply and effectively protection across all supported Linux distributions and
protects Linux workloads, including containers, running in all deployments — physical, virtual, cloud and containers
environments, from public and private clouds to on-premises
and hybrid data centers. Identifies Linux containers running in your
environment, including those running with potentially
risky configurations

Enables and accelerates threat hunting and

investigation
 CrowdStrike Solutions

PROTECTING LINUX WITH THE FALCON PLATFORM

FALCON CONTAINER
KEY CAPABILITIES SECURITY
PREVENTION count showing the number of connections
made in the last hour — with events recalled
The CrowdStrike® Falcon platform for up to 90 days Secures the host and
combines protection technologies including container via a single agent
Provides unified visibility across all running on the Linux host
machine learning (ML), artificial intelligence
workloads, enabling detection and
(AI), behavior-based indicators of attack
investigation of attacks that span multiple Investigates container
(IOAs) and custom hash blocking to defend
workload types and cloud environments incidents easily when
Linux workloads against malware and
detections are associated
sophisticated threats: Includes CrowdScore™ Incident Workbench
with the specific container
ML and AI prevent known and unknown to unravel attacks and improve response time and not bundled with the
by distilling and correlating security alerts into host events
malware, including those running within
incidents, automatically triaging, prioritizing
containers, without requiring scanning or
and highlighting those that deserve urgent Captures container start,
signatures
attention stop, image and runtime
Behavior-based IOAs block suspicious information, and all events
processes and prevent sophisticated 
Provides response capabilities that generated inside the
fileless and malware-free attacks allow you to contain and investigate container, even if it only runs
compromised workloads for a few seconds
Custom IOAs enable you to define unique
behaviors to detect and block 
Accelerates investigation by mapping
alerts to the MITRE ATT&CK® framework Provides visibility into
Hash prevention allows you to define
container footprint —
your own blacklist including on-premises
Integrated threat intelligence delivers the MULTI-CLOUD WORKLOAD DISCOVERY and cloud deployments
— and shows container
complete context of an attack, including To provide visibility into the scope and nature usage, including trends,
attribution of public and hybrid cloud footprints, Falcon: uptime, images used and
configuration to identify
Managed threat hunting 24/7 ensures that 
Automatically discovers existing cloud risky and misconfigured
stealthy attacks don’t go undetected and workload deployments — without installing containers
that breaches are stopped an agent — by enumerating existing
Amazon Web Services (AWS) Elastic Offers a single management
INTELLIGENT EDR Compute Cloud (EC2) instances, Google console for host and
Cloud Platform (GCP) Compute Engine container security
The CrowdStrike Falcon platform’s intelligent
instances and Microsoft Azure virtual
EDR:
machines
Continuously monitors events to provide

Provides real-time information about Linux
visibility into Linux workload activities,
workloads, including context-rich metadata
including activities running inside
about system size and configuration,
containers; a full set of enriched data
networking, and security group information
and event details allows investigations
for AWS, GCP and Azure
against ephemeral and decommissioned
workloads 
Identifies Linux workloads that are not
protected by the Falcon platform
Captures unique network events for Linux
to identify processes that are making 
Offers insight into your cloud footprint so
network connections, the protocol used, you can secure all workloads, uncover and
and local and remote server details and mitigate risks, and reduce the attack surface
 CrowdStrike Solutions

PROTECTING LINUX WITH THE FALCON PLATFORM

SIMPLICITY AND PERFORMANCE 

Installation and day-to-day
operations bear zero impact on hosts
FALCON PROVIDES

CrowdStrike’s cloud-native platform — even when analyzing, searching BROAD SUPPORT
eliminates complexity and simplifies and investigating
security operations to drive down

Falcon enables proactive threat
operational cost
hunting across all workloads and CrowdStrike Falcon

It operates without the need for systems from the same console provides comprehensive
constant signature updates, on- protection coverage that

It deploys and is operational in
premises management infrastructure can be deployed across
minutes Linux distributions (Amazon
or complex integrations
Linux, Red Hat, CentOS,
Oracle, SUSE, Debian and
Ubuntu). It is compatible
with all public clouds —
AWS, GCP and Microsoft
Azure.
ABOUT CROWDSTRIKE Broad container support
CrowdStrike® Inc. (Nasdaq: CRWD), a global cybersecurity leader, is redefining includes Open Container
Initiative (OCI)-based
security for the cloud era with an endpoint protection platform built from
containers such as Docker
the ground up to stop breaches. The CrowdStrike Falcon® platform’s single
and Kubernetes and also
lightweight-agent architecture leverages cloud-scale artificial intelligence (AI) and
self-managed and hosted
offers real-time protection and visibility across the enterprise, preventing attacks orchestration platforms
on endpoints on or off the network. Powered by the proprietary CrowdStrike such as GKE (Google
Threat Graph®, CrowdStrike Falcon correlates over 3 trillion endpoint-related Kubernetes Engine),
events per week in real time from across the globe, fueling one of the world’s most EKS (Amazon Elastic
advanced data platforms for security. Kubernetes Service), ECS
(Amazon Elastic Container
Service), AKS (Azure
Kubernetes Service) and
OpenShift.

Start Free Trial

of Next-Gen AV

Learn more at www.crowdstrike.com

© 2020 CrowdStrike, Inc. All rights reserved.