QuestionQ9Verified/Falcon Identity Protection FundamentalsCopy linkReport a problemAsk AstroTutorSave questionHow does Falcon Identity Protection analyze and inspect authentication traffic?ALogs are manually interpreted by SOC analystsBEndpoint and Domain Controller authentication log parsing and analysisCRelies on Falcon LogScale for log analysisDNear real-time network analysis on the Domain ControllerShow AnswerAnswerExplanationFalcon Identity Protection performs real-time inspection of authentication protocols, including Kerberos, NTLM, and LDAP, through its visibility at the Domain Controller. This enables live authentication-traffic analysis rather than log-only analysis. CrowdStrike: Detecting Kerberos Relay Attack via DNS CNAME AbuseLearn moreCrowdStrike: Detecting Kerberos Relay Attack via DNS CNAME AbuseShow comments0Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion