How to Use Falcon X for Automated Threat Intelligence

Falcon X is CrowdStrike’s automated threat intelligence platform that enables security teams to analyze, investigate, and respond to threats faster. It integrates malware sandboxing, threat intelligence reports, and IOC enrichment into the Falcon Console, helping organizations proactively defend against emerging threats.

This guide explains how to use Falcon X to analyze threats and gather intelligence on malicious activity.

---

Step 1: Log Into the Falcon Console

1. Open a browser and go to: https://falcon.crowdstrike.com or https://falcon.us-2.crowdstrike.com/ (Varies by tenant).
2. Sign in using your admin credentials.
3. In the left-hand menu, navigate to Falcon X.

---

Step 2: Submit a File for Malware Analysis

1. Go to Threat Intelligence > Falcon X Sandbox.
2. Click Submit New File.
3. Upload a file for analysis (e.g., suspicious executable, document, or script).
4. Choose the analysis mode:
5. Standard – Runs a quick automated check.
6. Extended – Provides in-depth sandboxing results.
7. Click Submit and wait for the sandbox results. 📌 Note: Falcon X will detonate the file in a safe environment, analyze its behavior, and generate a threat intelligence report.

---

Step 3: Review Falcon X Sandbox Analysis

1. Once the analysis is complete, open the Falcon X Report.
2. Review:
3. File behavior (e.g., process execution, network activity).
4. MITRE ATT&CK Tactics & Techniques used by the malware.
5. Command and Control (C2) communication indicators.
6. Associated IOCs (file hashes, domains, IP addresses).
7. If the file is malicious, move to contain the threat.

---

Step 4: Investigate Threat Intelligence Reports

1. Navigate to Falcon X > Intelligence Reports.
2. Search for known threat actors, malware families, or tactics.
3. Use the intelligence to:
4. Understand attacker motives and techniques.
5. Identify if the attack is part of a larger campaign.
6. Proactively block related threats using CrowdStrike’s IOCs.

---

Step 5: Export IOCs and Automate Response

1. Navigate to Threat Intelligence > IOCs.
2. Export malicious indicators and apply them to:
3. Firewall rules (block known bad IPs).
4. Endpoint security policies (prevent execution of similar files).
5. SIEM integration (correlate threats across logs).
6. Configure automated playbooks in Falcon X to streamline future responses.