We are pleased to partner with CrowdStrike’s Falcon Complete, a best-in-class security service provider with a team of expert analysts that can provide 24/7 monitoring of alerts. Falcon Complete integrates seamlessly with your existing Zip setup to provide coverage.
The below table outlines when and how we notify you or your chosen security contact regarding new discoveries.
- Medium, High and Critical alerts: You can expect all Medium and above severity detections and all incidents (> 2.5 CrowdScore) to be triaged on your behalf. If necessary, Falcon Complete team is authorized to take the following action on hosts:
- Network containing the host (disabling internet access)
- Rebooting or shutting down the host
- Take any of the following real time response actions:
- List running processes and kill processes
- Navigate the file system, get or delete files, and perform many file system operations
- Retrieve memory dumps (Windows only)
- Query, create, or modify registry keys (Windows only)
- Low and information alerts: The Falcon team will clean up Low level alerts but not report on them.
- Communication from us: You can expect to hear from Zip within 24 hours of an incident that requires network containing, rebooting, or taking any of the above Real Time Response actions with a full incident writeup.
- Zip Console Controls: If you use Falcon complete, certain functionality in the Zip Console will be disabled since they are the responsibility of the Falcon complete team. The following controls will be disabled:
- CrowdStrike sensor updates
- CrowdStrike detection policy
- CrowdStrike prevention policy
If you have additional questions, please feel free to reach out to success@zipsec.com.