Crowdstrike was one of the first companies doing EDR, and have a first mover advantage they have held onto. Lots of other companies offer good solutions now, but crowdstrike is still considered the gold standard, and they have worked hard to become the “default” for their market segment.
Also thanks to ebpf it’s now very easy to implement EDR without a full blown rootkit in Linux and anyone on the bleeding edge is moving away from this kind of solution
What CrowdStrike is actually selling, is someone who actually looks at the system logs and who pushes a button when something pops up. Roughly.
There are better solutions on the market. Unfortunately CrowdStrike has the more aggressive sales team.
For those wondering, I’m referring to *nix based solutions like SElinux, appArmor, iptables, nftables, cgroups, …
But you need to monitor your logs if you want to take appropriate action.
Or in other words, everyone else is complete shit.
No, but yes.
Crowdstrike was one of the first companies doing EDR, and have a first mover advantage they have held onto. Lots of other companies offer good solutions now, but crowdstrike is still considered the gold standard, and they have worked hard to become the “default” for their market segment.
Also thanks to ebpf it’s now very easy to implement EDR without a full blown rootkit in Linux and anyone on the bleeding edge is moving away from this kind of solution
No, it’s not a binary thing. There are other EDR products but they are the largest.
What CrowdStrike is actually selling, is someone who actually looks at the system logs and who pushes a button when something pops up. Roughly.
There are better solutions on the market. Unfortunately CrowdStrike has the more aggressive sales team.
For those wondering, I’m referring to *nix based solutions like SElinux, appArmor, iptables, nftables, cgroups, … But you need to monitor your logs if you want to take appropriate action.
Crowdstrike marketed to c-suites better than the others.