Who does what
Provider
- Triage Falcon alerts 24/7
- Hunt threats with Falcon OverWatch
- Contain and remediate under agreed playbooks
Your team
- Deploy and maintain required Falcon modules
- Set approvals and business exceptions
- Cover tools and telemetry outside scope
Coverage
- Endpoints
- Cloud Workloads
- Identity & Access
Details
Service scope
Best for Mid-market and enterprise teams standardizing detection and response on Falcon
Falcon platform
Falcon Complete operates CrowdStrike tools. Endpoint, cloud and identity coverage depends on the Falcon modules included.
Third-party telemetry
Non-Falcon signals require agreed Next-Gen SIEM scope. Confirm which sources analysts monitor and respond to, rather than only ingest.
Channel ownership
When buying through a partner, confirm tenant control, support, renewal terms and any separate managed SOC layer.
Full service analysis
CrowdStrike Falcon Complete is a managed detection and response service where CrowdStrike operates Falcon for 24/7 triage, threat hunting, containment and remediation across in-scope endpoint, cloud and identity telemetry. Third-party telemetry is handled through Falcon Next-Gen SIEM when that scope is included.
- Your team owns
- Deploying and maintaining required Falcon modules
- Setting response playbooks, approval rules and business exceptions
- Coverage outside Falcon modules or Next-Gen SIEM data sources that are not in scope
Market position
Falcon Complete is platform-led MDR, not a tool-flexible SOC provider. It makes sense when the buyer wants CrowdStrike to operate Falcon rather than add a separate MDR service over another endpoint platform.
Scope boundary
CrowdStrike can extend the service beyond native Falcon endpoint, identity and cloud telemetry through Falcon Next-Gen SIEM. Buyers should verify which third-party sources are monitored by the Complete team, which are only ingested and which require separate managed SIEM scope.
Channel buying
Falcon Complete can be sold through service providers. In that model, buyers should confirm whether they are buying Falcon Complete itself, who owns day-to-day support and whether the partner adds a separate managed SOC layer for items outside CrowdStrike's scope.
Pricing & contract
- Billing
- Per-endpoint, Custom
Request a quote for the endpoint population and required Falcon modules. Identity, cloud and Next-Gen SIEM scope can add to the package. Confirm the contract term and any minimum order with the seller.
Tradeoffs & buying questions
Strengths
-
Analysts operate the Falcon detection platform
CrowdStrike analysts operate the same Falcon platform that generates the detections
-
Falcon OverWatch hunting included in operating model
Falcon Adversary OverWatch is part of the Falcon Complete operating model
-
Pre-approved playbooks reduce containment handoffs
Pre-approved playbooks can allow containment without waiting for each customer action
Considerations
-
Requires Falcon as the principal endpoint response platform
Falcon needs to be the main endpoint and response platform
-
Broader coverage can require modules or Next-Gen SIEM
Cloud, identity and third party data coverage can require additional Falcon modules or Next-Gen SIEM scope
-
Compare required modules, service scope and renewal terms in the quote
Ask before buying
- Which Falcon modules and Managed NG-SIEM scope cover our endpoint, cloud, identity and third-party telemetry?
- Which containment and remediation actions are pre-approved, and which need our approval?
- Who controls tenant administration, support escalations and renewals when we buy through a partner?
Customer feedback
Customers value
-
Analyst coverage outside the internal team’s working hours
-
Clear incident explanations and investigation guidance
Reported concerns
-
Some reviewers want more help developing detection policies
-
Incident assignment and categorization can be difficult
Integrations
Platform / SIEM
- CrowdStrike Falcon Next-Gen SIEM
Endpoint
- CrowdStrike Falcon Insight XDR
Cloud
- AWS
- Azure
- GCP
Other integrations
- CrowdStrike Falcon Identity Threat Protection
- CrowdStrike Falcon Adversary OverWatch
- CrowdStrike Charlotte AI
1 more integrations
- CrowdStrike Falcon Fusion SOAR
Common questions
How is Falcon Complete different from Falcon OverWatch?
Falcon OverWatch is managed threat hunting. Falcon Complete includes managed triage and response by the Falcon Complete team, with OverWatch used as part of the service.
Does Falcon Complete replace a full SOC?
It can take over managed triage, hunting and response for in-scope Falcon telemetry and supported Next-Gen SIEM incidents. Buyers still own security strategy, policy decisions, business approvals and any environment outside the quoted scope.
Is Falcon Complete pricing public?
CrowdStrike quotes Falcon Complete through sales. Public reseller and AWS pages show limited offers with different scope or incomplete billing terms, so request a current quote covering your endpoint count, modules and contract term.
Company details
- Headquarters
- Austin, Texas
- Founded
- 2011