CrowdStrike Falcon: IT Responder & Triage Portal

Self-Paced IT Curriculum

CrowdStrike University IT Fundamentals to Triage Track

These four complimentary modules provide the knowledge required for frontline IT support to verify endpoint sensor health, assess Falcon detection alerts, review process trees, and respond to security events.

Total Time: ~2 hours 20 mins No Training Credits Required (Free Tier) Practical Checkpoints Included

Phase 1 • Platform Foundations

50 mins

FALCON 101: Falcon Platform Essentials

Master the layout of the Falcon console, understand agent communication back to the cloud, and locate hosts using host management.

Key Learning Points:

Sensor communication architecture over outbound TCP port 443
How to identify hosts in Reduced Functionality Mode (RFM)
Navigating the Activity App vs Host Management App

Tenant Checkpoint:

Log into your live Falcon tenant, navigate to Host Setup > Host Management, and filter by "RFM: Yes" to audit unprotectable machines.

Status: Pending Launch Course

Phase 2 • IT Operations & Hygiene

25 mins

FALCON 185: Falcon for IT Fundamentals

Understand how IT operations teams use Falcon for asset visibility, managing sensor update channels, and day-to-day endpoint troubleshooting.

Key Learning Points:

Inventory discovery and identifying rogue unmanaged devices
Managing static vs dynamic host sensor groups
Staging sensor update policies across pilot and production tiers

Tenant Checkpoint:

Review your organisation's current Sensor Update Policy to check whether devices are pinned to an older version or tracking the latest builds.

Status: Pending Launch Course

Phase 3 • Detection Logic & ATT&CK

25 mins

FALCON 109: MITRE ATT&CK & Detection Methods

Understand why Falcon triggers alerts. Learn to distinguish between static file indicators (IOCs) and adversary behaviours (IOAs).

Key Learning Points:

IOCs (Signatures/Hashes) vs IOAs (Indicators of Attack/Behaviours)
How to interpret MITRE tactics: Initial Access, Execution, Persistence, Lateral Movement
Distinguishing between Machine Learning pre-execution blocks and runtime IOA blocks

Tenant Checkpoint:

Open any alert in Activity > Endpoint Detections and click the "MITRE ATT&CK" badge to see the mapped adversary technique.

Status: Pending Launch Course

Phase 4 • Incident Triage & Scenarios

38 mins

CCFR: Falcon Responder Practice Exam

Test alert triage capabilities with real-world scenarios. Covers process tree analysis, command-line arguments, and containment actions.

Key Learning Points:

Reading parent-child process execution trees (e.g. Outlook spawning PowerShell)
De-obfuscating Base64 encoded CLI parameters and download cradles
Decision threshold: When to apply Network Containment vs when to mark as False Positive

Practical Drill:

Complete all scenario questions, record the rationale behind missed answers, and discuss them during team catch-ups.

Status: Pending Launch Exam

IT Fast-Triage Playbook: What to do when an alert fires

Follow this 3-step investigation process whenever a notification appears in Falcon Activity.

STEP 01 Action Status

Did Falcon Block It?

Check the alert badge header:

PREVENTED: Malicious binary was blocked or quarantined. Threat contained.

DETECTED: Action executed and logged, but NOT blocked by policy! Immediate review needed.

STEP 02 Execution Tree

Who is the Parent Process?

Look above the red flagged process in the Execution Tree:

Abnormal: outlook.exe or chrome.exe spawning PowerShell or CMD.
Legitimate IT: RMM tools, ConfigMgr (ccmexec.exe), or scheduled IT backup scripts.

STEP 03 Command Line

Inspect Execution Arguments

Click the process node and inspect the full command line string:

Look for -enc (Base64 payload)
Look for DownloadString or certutil -urlcache
Look for -ExecutionPolicy Bypass

Triage Action Decision Matrix

Scenario	Immediate IT Action	Falcon Status Update	Prevention / Tuning
Active Threat / Lateral Movement	Apply Network Containment immediately via Host details. Do NOT reboot (preserves RAM). Escalate to lead admin.	In Progress → True Positive	Scan related hosts, check credentials, investigate lateral movement.
Commodity Malware Blocked	Verify prevention state shows "Quarantined/Blocked". Contact user to verify download source.	Closed → True Positive (Prevented)	Standard web filter / email policy review.
Legitimate IT Tool / Internal Script	Verify hash and confirm script author. Confirm action was authorized IT maintenance.	Closed → False Positive	Add SHA256 ML Exclusion or targeted IOA exclusion if alert is recurrent.

Standard Alert Closing Template

Copy this standard note into the Falcon detection comment box before closing any incident.

[TRIAGE NOTE] 
Analyst: [Your Name] | Resolution: [False Positive / True Positive]
Investigation: Verified parent process [e.g. ccmexec.exe] and command line. Activity confirmed as legitimate scheduled IT automation.
Action Taken: Closed alert; no further host containment required.

Interactive Triage Scenario Drills

Put your CCFR practice into action with these common operational situations.

Scenario 1 • High Severity Detection

Suspicious PowerShell Download Cradle

Detection #812

Process Tree Snapshot:

OUTLOOK.EXE (PID 4820)

└── WINWORD.EXE (PID 7112)

└── powershell.exe -ExecutionPolicy Bypass -NoProfile -enc SQBFAFgA... (PID 9340)

What is the immediate priority action for an IT team member?

Scenario 2 • Medium Severity IOA

IT Systems Management Script Alert

Detection #813

Process Tree Snapshot:

services.exe (PID 620)

└── CcmExec.exe (PID 1804) [Microsoft ConfigMgr]

└── cmd.exe /c "wmic computersystem get model" (PID 3302)

How should the IT team handle this detection?