AI security & operations for MSPs

CrowdStrike Falcon

A Falcon detection is a fact about a host. Hal reads it next to the same user’s sign-ins and mailbox activity, so it arrives as a conclusion rather than one more console to check.

What Hal reads
Falcon alerts across every product that raises them (Prevent, Insight, Identity, Cloud, Mobile where licensed): severity, tactic and technique, the host and user involved, the file or command line behind it. Falcon’s scored automated leads too, once Falcon itself scores them high enough to matter.
What it enables
A detection judged in context. The vendor’s verdict escalates on its own weight, then Hal’s investigation reads it beside the same user’s sign-ins, consents and mailbox rules and writes one report.
How it connects
A read-only API client you create in your Falcon console, two scopes, one per CID. Hal cannot change an alert, assign it, or touch a host. Read-only by architecture →
Setup
Console steps, scopes and the hand-off to Hal: in the docs →
A chat exchange in the Hal portal: asked what Falcon has flagged at a client this week, Hal lists two detections with severity, host, technique and what Falcon did, notes that one coincided with a suspicious sign-in and was escalated with a credential reset and host isolation, and that no automated leads reached Falcon's score floor
Two detections, one of them worth a report. The credential-dumping block on one workstation landed twenty minutes after a new-device sign-in on the same account, so it became an escalation with the fix attached. The other was quarantined by Falcon and, with clean sign-ins behind it, recorded and left alone.

See what Hal surfaces on your own clients.

No deck. Ask us anything first. When you want to see Hal on your own tenants, we sign a short evaluation agreement and stand up your instance; you connect one tenant, Hal watches it for 14 days, and we walk you through what he found.

Book a walkthrough Pricing
  1. 01You ask us your questions. No deck, no demo dataset.
  2. 02You sign a short evaluation agreement, and we stand up your own instance.
  3. 03You connect one tenant from your own admin console. Hal watches it for 14 days.
  4. 04We walk through what he found. Keep going month to month, or revoke the scopes yourself and stop.