We’re thrilled to announce that Dropzone AI is available for purchase on the Crowdstrike Marketplace! Organizations that use Crowdstrike will now be able to more easily add Dropzone’s AI SOC Analyst to their team, speeding up triage and investigations of security alerts. To view the press announcement, click here.
Our integration with Crowdstrike focuses on the Falcon agent. One of the highlights of the integration is that our agentic system is trained to use the Crowdstrike threat graph to build a process tree. It then uses its specialized knowledge to describe what a process is doing overall and analyze what in the process tree looks suspicious (such as the obfuscation techniques in the example above).
The Opportunity Cost of Time-Consuming Alert Investigation
Cybersecurity teams today spend between 20% and 40% of their time triaging and investigating their alert queues, depending on the volume of alerts. In terms of opportunity cost, this time could arguably be more profitably spent doing other tasks that will significantly improve the security posture of the organization, such as:
- Working with operations teams to improve instrumentation and visibility
- Working with applications teams to improve application security, such as by coordinating training and implementing DevSecOps processes
- Incident response planning, including table top exercises
With Dropzone AI, it is now possible to automate the complex and unpredictable work of alert triage. Our customers have seen the amount of time they spend on manual alert investigations drop by 90%. Consider what your SOC would be able to accomplish if it had 20-40% more time!
The Problem of Schrodinger’s Alerts
Like Schrodinger’s Cat, you don’t know the certain disposition of an alert sitting in your queue until you triage and investigate it—is it benign or malicious? It’s a Schrodinger’s alert, in an indeterminate state until investigated. In today’s SOCs, enrichment of IOCs can make answering this question easier but it still requires a human analyst to gather more data and then connect the dots. Dropzone AI goes through your alert queue for you, collapsing all those Schrodinger’s alerts into either true or false positives so that human analysts only look at the alerts that warrant their precious time.
Take this scenario for example:
- Crowdstrike detects a potentially malicious process execution on an endpoint. The alert asks the analyst to “Review any binaries involved as they might be related to malware.”
- The alert is sent to Dropzone AI for triage and investigation.
- Dropzone AI formulates a hypothesis for the alert, as a human analyst would, and then formulates the investigation steps required to test the hypothesis.
- Dropzone AI employs expert modules (pre-trained LLMs) to reconstruct and analyze the process tree of the execution.
- Dropzone AI identifies potential obfuscation techniques in a Powershell script included in the process. This is a strong signal for malicious intent.
- More damningly, several domains invoked by the process are associated with malware based on checks with reputation services.
- Dropzone AI concludes the alert indeed represents malicious activity and should be escalated for incident response.
View the product tour below to see how this works.
Speed Up Response to Crowdstrike Alerts
By autonomously investigating alerts, Dropzone AI speeds up mean-time-to-acknowledge, or the time from detection to when the SOC can start validating an alert. Typically, alerts sit unopened in a queue for up to hours depending on the criticality, staffing level, and time of day. Dropzone’s AI SOC analyst triaging the alert queue is like nitrous oxide for your SOC engine—it speeds things up! Human analysts can identify and respond to the relatively rare true positive alerts much faster.
Time is the most valuable resource in any SOC, and with Dropzone AI integrated with Crowdstrike, you can give your team hours back each day and focus on what truly matters—proactive security. Ready to collapse the wave function on all those Schrodinger’s alerts? Get Dropzone AI on the Crowdstrike Marketplace!
