Falcon Identity identifies anomalous identity behavior from observed activity and uses those anomalies to form detections. An incident is a higher-level grouping of related detections, and TTPs are behavioral context used to characterize malicious activity rather than the components of a detection. CrowdStrike describes Falcon Identity Protection as baselining normal user behavior to identify anomalies and generate threat detections.
Community Discussion