QuestionQ28Verified/Incident Workbench and SIEM AlertsCopy linkReport a problemAsk AstroTutorSave questionWhat distinguishes a first-party detection from a third-party detection?AFirst-party detections are those native to the platform, while third-party detections are those created by the customer’s security teamBFirst-party detections can be seen by all users, while third-party detections require special roles and permissions to be viewedCFirst-party detections are a higher severity than third-party detections and should be triaged firstDFirst-party detections are those native to the platform, while third-party detections are generated from data sources external to the platformShow AnswerAnswerExplanationFirst-party detections are generated natively by the CrowdStrike Falcon platform. Third-party detections originate from external data sources or security products that are integrated with the platform. CrowdStrike describes Next-Gen SIEM as ingesting third-party data and distinguishes Falcon’s first-party endpoint, identity, and cloud data from that third-party data.Learn moreCrowdStrike: Simplifies Ingestion of High-Value Data Into the Falcon PlatformCrowdStrike: Falcon Adversary OverWatchShow comments0Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion