It's one thing having the products do detect, it's another to have the actual skills to understand how to use and respond. MDI, CS or what ever. I see orgs putting it in place and getting annoyed by the noise. Not spending the time tuning. Not spending the time learning how to hunt. Not spending the time understanding what's normal in an environment. If you don't put the work in, the tool just sits there not monitored. Answer from Deleted User on reddit.com
CrowdStrike
crowdstrike.com › en-us › blog › 9-ways-a-public-sector-ciso-uses-crowdstrike-identity-threat-protection
9 Ways a CISO Uses CrowdStrike Identity Threat Protection
December 21, 2024 - With Falcon Identity Threat Protection, we can enforce frictionless, risk-based multifactor authentication (MFA) when a privileged user remotely connects to a server — stopping adversaries trying to move laterally. Additionally, we can define policies to reset passwords or block/challenge ...
CrowdStrike
crowdstrike.com › platform › next-gen identity security › identity protection
AI-Powered Identity Protection for Hybrid Environments | CrowdStrike
2 weeks ago - Extend context-aware MFA, for consistent protection across your hybrid environment. ... Minimize risk with just-in-time access for privileged roles using Falcon Privileged Access. Enforce least privilege, detect threats, and stop misuse — all on the same platform that secures your full identity lifecycle. Augment your team with CrowdStrike experts who monitor, detect, and respond to identity threats around the clock.
Videos
What is identity security?
Identity security, sometimes referred to as identity protection, is like the bouncer at a VIP event, ensuring every identity is verified, authorized, and monitored to prevent unauthorized access. It’s a comprehensive practice designed to protect all types of identities across on-premises, hybrid, and cloud environments, stopping adversaries from exploiting stolen credentials to bypass defenses.
crowdstrike.com
crowdstrike.com › en-us › cybersecurity-101 › identity-protection
Identity Protection: What It Is and Why You Need It | CrowdStrike
Why is identity security critical?
In a world where identities are often the weakest link, securing them isn’t just an IT concern — it’s a business imperative to protect your organization from identity-driven breaches and evolving cyber threats.
crowdstrike.com
crowdstrike.com › en-us › cybersecurity-101 › identity-protection
Identity Protection: What It Is and Why You Need It | CrowdStrike
What are the components of identity security?
Authentication, authorization, privilege access management, threat detection and response, logging and monitoring, and identity lifecycle management are all identity security components that work together to verify users, manage access, and stop threats before they cause harm.
crowdstrike.com
crowdstrike.com › en-us › cybersecurity-101 › identity-protection
Identity Protection: What It Is and Why You Need It | CrowdStrike
CIO Solutions
ciosolutions.com › home › a hands-on deep dive into crowdstrike identity protection
CrowdStrike IDP: A Hands-On Deep Dive
October 25, 2025 - Explore key CrowdStrike IDP features and uses including risk detection, threat hunting, MFA enforcement, and more.
CrowdStrike
crowdstrike.com › en-us › resources › videos › identity-protection-solution
How CrowdStrike's Identity Protection Solution Works
July 2, 2024 - Learn how CrowdStrike Identity Protection -- fully integrated with the CrowdStrike Falcon® Platform -- helps ensure comprehensive protection against identity-based attacks in real-time. CrowdStrike Falcon® AI Detection and Response Data Sheet · AI Agent Security: Architecture, Attack Surface, and Defense · Taxonomy of Prompt Injection Methods · Case Studies ·
Reddit
reddit.com › r/activedirectory › crowdstrike identity for ad - anyone using it?
r/activedirectory on Reddit: Crowdstrike Identity for AD - anyone using it?
February 19, 2024 -
This month our CISO was made aware of a new acronym..... ITDR and now I've been tasked with identifying who provides "ITDR" *sigh* to that end I found CrowdStrike Identity and the Identity module.
However, we are not a CrowdStrike customer yet (Windows Defender - Ex licenses), but the identity module looks like it may cover some aspects of what we are looking for, can anyone confirm:
detecting password/brute force spray attacks
auto remediation of attacks if successful i.e. reset passwords/disable account
detecting of kerberoasting or suspicious attacks leading to kerberoasting attacks
mfa step up for anomalous type logons (i've seen this in a youtube video) - but what MFA providers?
block authentication from non-domain joined devices (i.e employees tryin to use own devices)
can you buy just "identity"?
Does Identity (or is there another module) that does anything similar to pingcastle to look at "identity security weaknesses", I did notice they partner with Trimarc who have their own tool for this?
Is there anyway to identify if a compromised account made any changes inside Entra or AD? Did they reset passwords, implant backdoors?
We are not yet at the demo/trial stage just looking at who offers what and then will narrow it down for some kind of comparison (we are not adverse to moving from Defender...)
Sorry for so many questions if anyone can help answer any of these it would be much appreciated.
Top answer 1 of 7
9
Take a look at MS Defender for Identity
2 of 7
2
It's one thing having the products do detect, it's another to have the actual skills to understand how to use and respond. MDI, CS or what ever. I see orgs putting it in place and getting annoyed by the noise. Not spending the time tuning. Not spending the time learning how to hunt. Not spending the time understanding what's normal in an environment. If you don't put the work in, the tool just sits there not monitored.
CrowdStrike
crowdstrike.com › en-us › cybersecurity-101 › identity-protection
Identity Protection: What It Is and Why You Need It | CrowdStrike
September 15, 2025 - Risk-Based MFA: Dynamically adjust access requirements based on real-time threat intelligence, ensuring seamless security without disrupting user workflows. Streamlined Integration: Enhance your existing IAM systems and secure even legacy applications with CrowdStrike’s flexible architecture. With Falcon Next-Gen Identity Security, you’re not just protecting identities — you’re gaining a fully integrated, proactive defense against the evolving threats targeting your organization’s most critical assets.
AWS Marketplace
aws.amazon.com › marketplace › pp › prodview-coqbkblyhbdi4
AWS Marketplace: CrowdStrike Falcon Identity Protection
I am using the lightweight agent. For the system performance, the lightweight agent is fine; it has not affected performance too much, and generally it's acceptable. I rate CrowdStrike Falcon eight out of ten. ... The main use cases for CrowdStrike Falcon from my customers are the lightweight ...
ePlus
eplus.com › docs › default-source › default-document-library › crowdstrike-falcon-identity-protection-modules-solution-brief.pdf pdf
crowdstrike falcon identity protection modules
At ePlus, we engineer transformative technology solutions for the most visionary companies in the world.
CrowdStrike
crowdstrike.com › tech-hub › identity-protection › build-cusotm-insights-with-falcon-identity-protection
Using Custom Insights for Visibility with Falcon Identity Protection | Tech Hub
October 15, 2025 - We’ll build out a custom insight as an example that will look for human, administrator accounts with compromised passwords. Falcon Identity Protection detects accounts that have compromised, and/or duplicate passwords that attackers could take advantage of. Keep in mind this is just one example. You can build custom insights around a variety of security and operations use cases.
CrowdStrike
crowdstrike.com › platform › next-gen identity security › proactive services
Proactive Services | CrowdStrike Falcon® Identity Protection
November 17, 2025 - Get complete visibility and real-time protection across traditional Active Directory (AD) and cloud identity providers such as Entra ID and Okta, empowered with industry-leading threat intelligence. Implement risk-based MFA across your environment with the MFA provider of your choice. Enforce additional security measures when suspicious activities are detected, ensuring robust protection without disrupting user experience. “We now have a partner in CrowdStrike that understands our organisation and what we’re protecting.
CrowdStrike
crowdstrike.com › tech-hub › identity-protection › crowdstrike-falcon-identity-protection-policies
Get Started with CrowdStrike Falcon Identity Protection Policies | Tech Hub
May 24, 2024 - The Template dropdown are prebuilt rules around common use cases, such as anomalous authentication. Use the template rules to immediately start protecting against identity threats in your environment.
Reddit
reddit.com › r/crowdstrike › crowdstrike identity, are you using it?
r/crowdstrike on Reddit: Crowdstrike Identity, are you using it?
March 9, 2023 -
Like the title says. How many of you are using it, how well has it worked for you? What problems have you had?
Edit: how long has Crowdstrike had the identity product?
Top answer 1 of 13
18
it is probably one of the best tools I have ever bought and addresses so much more than just security. it is one of the first places our teams go to investigate the various things that go bump in the night. also easily implemented mfa for admin duties and some other policies easily.
2 of 13
11
Yes, it's brilliant. The amount of pre-emptive securing you can do is just amazing. We're a k12 school, and the kids are forever setting weak passwords - with identity, we can force a password change as soon as a compromised password is detected.
CrowdStrike
crowdstrike.com › en-us › resources › data-sheets › identity-protection-services
Identity Protection Services Data Sheet
July 2, 2024 - CrowdStrike Identity Protection Services help you deploy the Falcon Identity Protection solutions to stop unauthorized access to your corporate network from compromised endpoints and misused credentials.
CrowdStrike
crowdstrike.com › platform › identity protection
Stop Identity Attacks in Real Time | CrowdStrike Falcon® Identity Protection
June 2, 2025 - Correlate identity, endpoint, and data protection to detect threats and stop lateral movement. Use real-time detection and agentic detection triage powered by Charlotte AI to analyze user behavior in context, uncover anomalies, and rapidly prioritize identity alerts.
CrowdStrike
crowdstrike.com › resources › videos › how-to-detect-and-prevent-suspicious-activities-with-falcon-identity-protection
Videos
August 7, 2025 - See Falcon Data Protection in Action · Video · Falcon Intelligence · Video · How CrowdStrike's Identity Protection Solution Works · Video · Falcon Complete: A Pioneer in MDR · Video · How to secure RDP access to DCs using Falcon Identity protection ·
CrowdStrike
crowdstrike.com › en-us › blog › crowdstrike-extends-identity-security-innovations
CrowdStrike Extends Identity Security Innovations to Protect Customers and Stop Breaches
December 17, 2024 - Today, we’re solving three new use cases for CrowdStrike Falcon® Identity Protection, while simplifying work for security analysts.
CrowdStrike
crowdstrike.com › wp-content › uploads › 2023 › 03 › crowdstrike-falcon-identity-protecton-modules.pdf pdf
CrowdStrike Falcon Identity Threat Detection and ...
Identity Threat Protection for active prevention of identity attacks. ... Falcon Identity Threat Detection represents the first level of detection for AD security. Falcon Identity · Threat Detection provides visibility for identity-based attacks and anomalies, comparing live traffic · against behavior baselines and rules to detect attacks and lateral movement. It provides real-time AD · security alerts on rogue users and sideways credential movement within the network or cloud.
Axonius
docs.axonius.com › docs › preempt
Asset Management for CrowdStrike Falcon Identity Protection | Axonius
It continuously analyzes, adapts and responds to threats based on identity, behavior, and risk to resolve insider threats and targeted attacks. ... It is possible to connect using either CrowdStrike or Preempt credentials.
GitHub
github.com › CrowdStrike › Identity-Protection
GitHub - CrowdStrike/Identity-Protection
This repository contains scripts and utilities for working with Crowdstrike Identity Protection.
Starred by 14 users
Forked by 6 users
Languages PowerShell
D3security
docs.d3security.com › integration-docs › integration-docs › crowdstrike-identity-protection
Crowdstrike Identity Protection
Identity Protection APIs. Log into CrowdStrike. Use the shortcut Ctrl + K (Windows) or Cmd + K (macOS) to bring up the search bar. Use it to find and select API clients and keys. On the API clients and keys page, click Add new API Client. The Add new API client will appear. Input a Client Name and a description (optional). Select the scopes for the API client according to the use case...