Financial Services · Managed platform (CrowdStrike)

Endpoint Detection & Response

Around-the-clock detection, hunting and response on CrowdStrike Falcon, run for you by Moraph

Book a demonstrationRequest a technical briefingFactsheet

Overview

What you are buying

Moraph resells, implements and runs CrowdStrike Falcon as a managed service across teller workstations, back-office PCs and servers at banks, credit unions and other financial firms. Falcon watches every endpoint for malicious behavior and blocks known threats; Moraph's analysts, working follow-the-sun from our offices, triage detections, hunt for activity that slipped past, and contain affected machines under rules you approve. Your security lead decides on anything beyond those rules, and you keep a full record of each incident.

The problem it solves

Branch and back-office workstations run all day, connect to the core banking system and payment applications, and are a common way in for ransomware and credential theft. Most community and regional institutions cannot staff a security operations team around the clock, so endpoint alerts raised overnight or at weekends wait until someone is in. Agents are deployed but not every machine reports, prevention policies are left in detect-only mode, and nobody has time to hunt for activity that did not raise an alert. When an incident does happen, notification clocks start running before the facts are known.

  • Endpoint alerts outside business hours wait until staff arrive
  • Some workstations and servers have no working sensor, and nobody notices
  • Prevention policies are left in detect-only mode for fear of disrupting branches
  • Incident facts needed for regulatory notification are assembled under pressure

Who uses it

  • Chief information security officers and information security officers at banks and credit unions
  • IT leaders responsible for branch, teller and back-office workstations
  • Risk and compliance leaders who answer for incident response and notification
  • Infrastructure teams who run core banking, payment and file servers
  • Internal audit and examiners, who need evidence of monitoring and response

Requirements it supports

Computer-Security Incident Notification Rule (12 CFR Part 53, 12 CFR Part 225 Subpart N, 12 CFR Part 304 Subpart C)Interagency Guidelines Establishing Information Security Standards (12 CFR Part 30 App. B, Part 364 App. B)NCUA Security Program and cyber incident notification rules (12 CFR Part 748)NYDFS Cybersecurity Regulation (23 NYCRR Part 500)Gramm-Leach-Bliley Act Safeguards Rule (16 CFR Part 314)FFIEC IT Examination Handbook, Information Security booklet

The product supports these requirements; meeting them remains your organization’s responsibility.

Responsibilities

Who is responsible for what

CrowdStrike provides and operates the Falcon platform, Moraph monitors and responds on it for you, and your institution approves the rules and makes the business decisions.

AreaMoraphCrowdStrikeYour organization
LicensingResells Falcon subscriptions and keeps counts aligned with your estateSets license terms and modulesAgrees the endpoints and modules and pays under the order
Platform availabilityMonitors console and sensor health and raises issues with CrowdStrikeOperates the Falcon cloud under its own service commitmentsTells Moraph about business impact
Sensor deploymentPlans deployment and checks coverage dailyProvides the sensor and deployment toolsDeploys sensors through your software distribution and fixes gaps
Policies and exclusionsProposes and applies prevention, update and containment settingsProvides the policy features and detection contentApproves every policy and exclusion
Monitoring and triageTriages detections around the clockGenerates detections from its detection contentProvides current escalation contacts
Threat huntingRuns hunts in your telemetryProvides telemetry and, if licensed, its own hunting serviceReviews hunt findings
Response actionsActs under the approved containment policy and escalates the restProvides containment and remote response featuresApproves the containment policy and decides on other actions
RecoveryConfirms affected machines are cleanProvides investigation dataRestores or rebuilds machines and systems
Platform updatesStages sensor updates and reviews platform changes for effect on your settingsReleases sensor and platform updatesApproves update windows for critical servers
Regulatory obligationsProvides incident facts and evidenceProvides platform attestations under its termsDecides on and makes any regulatory notification, and remains responsible for its security program

See how it works

A short walkthrough

Illustrative screens of how Moraph runs the service, with fictional sample data. They are not screens of CrowdStrike itself, which belongs to its vendor.

  1. Step 1

    Onboarding tracker

    Sensors are deployed in waves by host group, and each group moves to prevention only after review.

    Host groupMachinesSensors reportingPolicy modeContainment ruleStatus
    Pilot (IT staff)1818PreventAuto at highLive
    Back-office PCs214211PreventAuto at high3 missing
    Teller workstations162162Detect onlyAuto at criticalTuning
    Core and payment servers2424Detect onlyApproval requiredTuning
    Sensors are deployed in waves by host group, and each group moves to prevention only after review.

  2. Step 2

    Triage of an overnight detection

    A detection raised at night is reviewed, decided and acted on under the containment policy, with each step recorded.

    Incident IN-5170 · Teller workstation TW-BR07-03 (fictional)

    1. Falcon detection: suspicious script launched from email attachmentFalcon
    2. Process tree and related activity reviewed; judged maliciousMoraph security analyst
    3. Host network-contained under the approved containment policyMoraph security analyst
    4. On-call contact called and informedMoraph security analyst
    5. Hunt across estate for the same file and domain: no other hostsMoraph security analyst
    6. Machine rebuilt; containment lifted after confirmationClient IT with Moraph
    7. Incident report reviewed and closedSecurity lead
    A detection raised at night is reviewed, decided and acted on under the containment policy, with each step recorded.

  3. Step 3

    The containment policy

    The rules Moraph works within are written down and approved, so analysts can act at night without guessing.

    Containment policy · Example Community Bank (fictional)

    Teller workstations
    Contain at critical severity
    Back-office PCs
    Contain at high or critical
    Core and payment servers
    Never without approval
    Executive devices
    Call on-call contact first
    Approved by
    Security lead
    Next review
    At the next quarterly review

    Actions allowed without a call

    • Network containment
    • Stop a malicious process
    • Quarantine a malicious file
    The rules Moraph works within are written down and approved, so analysts can act at night without guessing.

  4. Step 4

    Sensor coverage check

    Every day, machines in your inventory are compared with machines reporting to Falcon, and gaps go to your IT team.

    HostLocationGroupIn inventoryLast seen by FalconAction
    BO-OPS-112Operations centerBack-office PCsYesNeverDeploy sensor
    BO-LND-031LendingBack-office PCsYes12 days agoCheck machine
    BO-HR-007Head officeBack-office PCsYesNeverDeploy sensor
    TW-BR11-02Branch 11Teller workstationsNoTodayAdd to inventory
    Every day, machines in your inventory are compared with machines reporting to Falcon, and gaps go to your IT team.

  5. Step 5

    An exclusion change request

    Exclusions that silence detections are added only with your security lead's approval, and are reviewed again later.

    Change CR-2216 · Exclusion for check imaging application

    Requested by
    Client IT
    Detection
    Repeated script behavior from check imaging update service
    Scope
    Back-office PCs, one signed executable path
    Risk
    Low: signed vendor binary, fixed path
    Review date
    Next quarterly policy review

    Approvals

    • Moraph analyst: recommended, narrow scope
    • Security lead: approved
    Exclusions that silence detections are added only with your security lead's approval, and are reviewed again later.

  6. Step 6

    Monthly service review

    Each month, Moraph and your security lead go through detections, incidents, hunts, coverage and decisions needed.

    AreaThis monthStatusDecision needed
    Detections146 triaged, 4 true positivesGoodNone
    Incidents1 high, contained and closedClosedNone
    Coverage3 back-office PCs without sensorsOpenClient IT to deploy
    PolicyTeller group ready for preventionReadyApprove move to prevent
    CrowdStrike noticesSensor release scheduledInformationalApprove server window
    Each month, Moraph and your security lead go through detections, incidents, hunts, coverage and decisions needed.

Workflows

The principal workflows

  1. Deploy and cover

    Moraph deploys the Falcon sensor across your estate with your IT team, sets prevention and update policies by host group, and checks every day that every machine you own is reporting.

    • Asset list agreed and host groups defined, such as tellers, back office and servers
    • Sensor deployed in waves, starting with a pilot group
    • Prevention policies moved from detect-only to blocking after review with you
    • Sensor update policies set so core and payment servers update on your schedule
    • Daily coverage check against your asset inventory

  2. Detect and triage

    Falcon raises detections from endpoint behavior. Moraph analysts review each one around the clock, decide whether it is malicious, and record the evidence and decision.

    • Detection raised by Falcon with its process tree and indicators
    • Moraph analyst reviews the detection and related host activity
    • False positives closed with a reason and tuning proposed where needed
    • True positives raised as incidents with severity under your agreed scheme
    • Your on-call contact told according to severity

  3. Hunt

    Moraph analysts search Falcon telemetry for signs of attack that did not raise a detection, such as unusual remote access tools, credential dumping or staging of data, focusing on techniques used against financial institutions.

    • Hunts planned from threat intelligence and techniques seen against financial firms
    • Queries run across endpoint telemetry
    • Findings investigated and raised as incidents where malicious
    • Hunt results and coverage recorded
    • New detection logic proposed from what the hunt found

  4. Contain and recover

    Under a containment policy you approve in advance, Moraph analysts can isolate a machine from the network, stop a process or quarantine a file using Falcon. Anything outside that policy goes to your security lead first.

    • Pre-approved actions applied for the host groups and severities you agreed
    • Other actions requested from your security lead and recorded
    • Affected machine investigated and scope of the incident established
    • Your IT team restores or rebuilds the machine; Moraph confirms it is clean
    • Incident report prepared with timeline, actions and facts for any notification decision

Roles and permissions

Who does what in the product

Each role below is a starting point. During implementation we set them up to match your teams, and every action anyone takes is recorded in the audit trail.

Security lead

Chief information security officer, information security officer, IT risk manager

Owns endpoint security for the institution, sets the rules Moraph works within, and decides on incidents.

Sees

  • All detections, incidents and hunts
  • Coverage, policies and exclusions by host group
  • Incident reports and timelines
  • Monthly service reviews

Does

  • Approves prevention, update and containment policies
  • Approves exclusions and tuning changes
  • Decides on response actions outside the pre-approved rules
  • Decides, with legal and compliance, whether an incident must be notified to regulators
  • Names on-call contacts and the escalation order

Cannot

  • Delete detections or incident records
  • Change the audit record of actions taken
Approvals
Approves policies, exclusions and the containment rules. Actions outside those rules need their approval or the on-call contact's.
Notified about
High and critical incidents straight away, other incidents under the agreed scheme, coverage gaps and the monthly review.

On-call contact

IT manager on call, deputy information security officer, operations duty manager

Represents the institution when an incident needs a decision out of hours.

Sees

  • Incidents escalated to them, with evidence and recommended actions
  • The containment policy and what Moraph has already done

Does

  • Answers escalations and authorizes or declines proposed actions
  • Brings in IT, branch operations or leadership as needed
  • Records their decisions with Moraph's analyst

Cannot

  • Change standing policies or exclusions
  • Close an incident without the security lead's review where severity requires it
Approvals
Their decisions on an incident are recorded and reviewed by the security lead.
Notified about
Escalations under the agreed severity scheme, by phone and email.

Client IT administrator

Desktop and server administrators, branch IT support, infrastructure team

Keeps sensors deployed and machines healthy, and restores machines after an incident.

Sees

  • Sensor status and coverage gaps
  • Incidents affecting their machines
  • Planned sensor updates and policy changes

Does

  • Deploys sensors to new and rebuilt machines
  • Keeps the asset inventory current
  • Fixes machines with missing or stale sensors
  • Restores or rebuilds machines after an incident
  • Tells Moraph about software that may trigger false detections

Cannot

  • Remove a sensor or change prevention policy without the security lead
  • Lift network containment on a machine without the analyst's confirmation
Approvals
Changes to their systems follow your own change process; sensor removals need the security lead.
Notified about
Coverage gaps, incidents on their machines and planned updates.

Moraph security analyst

Moraph security operations analysts and threat hunters

Watches your endpoints around the clock, investigates detections and hunts, and acts within the rules you approved.

Sees

  • Falcon detections, telemetry and host details for your estate
  • The containment policy, escalation contacts and incident history
  • Threat intelligence relevant to financial institutions

Does

  • Triages detections and records each decision with evidence
  • Raises incidents and escalates by severity
  • Contains machines, stops processes or quarantines files under the pre-approved rules
  • Runs hunts and investigates findings
  • Drafts incident reports and proposes tuning

Cannot

  • Take actions outside the containment policy without your approval
  • Add exclusions or change prevention policy without your approval
  • Access machines beyond what the investigation needs
Approvals
Actions beyond the containment policy and every policy or exclusion change need your security lead's or on-call contact's approval.
Notified about
Falcon detections, coverage alerts and requests from your team.

Moraph service manager

Named Moraph service manager

Owns the service relationship, change process and reporting.

Sees

  • All service reports, incidents and changes
  • CrowdStrike platform notices and support cases

Does

  • Runs the monthly service review
  • Manages change requests and their approvals
  • Follows platform issues with CrowdStrike support
  • Assembles evidence packs on request

Cannot

  • Approve changes on your behalf
  • Change the record of incidents or actions
Approvals
Changes they manage are approved by your security lead.
Notified about
High-severity incidents, platform notices and service issues.

Auditor or examiner (read-only)

Internal auditor, external auditor, regulatory examiner (under temporary access)

Checks that endpoint monitoring and response work as the institution's program says.

Sees

  • Coverage, detection and incident reports
  • Policies, exclusions and their approvals
  • Incident timelines within the scope granted

Does

  • Reviews evidence packs and reports
  • Requests additional detail through the security lead

Cannot

  • Change or delete anything
  • Keep access after it expires
Approvals
Their access is approved by the security lead, with a scope and an end date.
Notified about
Nothing by default.

Permissions at a glance

ActionSecurity leadOn-callClient ITMoraph analystMoraph SMAuditor
Triage and close detectionsFullView onlyNo accessFullView onlyView only
Raise and escalate incidentsFullView onlyNo accessFullView onlyView only
Contain hosts under agreed rulesFullApprovesNo accessFullNo accessNo access
Take actions outside agreed rulesApprovesApprovesNo accessOwn work onlyNo accessNo access
Lift network containmentApprovesApprovesOwn work onlyFullNo accessNo access
Change prevention policiesApprovesNo accessView onlyFullView onlyView only
Add or remove exclusionsApprovesNo accessView onlyFullView onlyView only
Deploy or remove sensorsApprovesNo accessFullView onlyNo accessNo access
Run threat huntsView onlyNo accessNo accessFullView onlyView only
Decide on regulatory notificationFullNo accessNo accessNo accessNo accessView only
Manage console users and rolesApprovesNo accessNo accessNo accessFullNo access
  • Full
  • Own work only
  • Approves
  • View only
  • No access

How access is controlled

  • The containment policy is the heart of the service. It lists which actions Moraph analysts may take on which host groups at which severities without waiting for you, and it is approved by your security lead and reviewed regularly.
  • Core banking, payment and other critical servers are usually excluded from automatic containment, so a decision to isolate them is always made by a person at your institution.
  • Console access for your staff and Moraph's follows single sign-on with multi-factor authentication, and every action taken in Falcon is recorded with the person and time.
  • Auditors and examiners receive temporary read-only evidence for a defined scope and period, approved by your security lead, rather than console accounts.

Features

What it does

Around-the-clock triage

Moraph analysts in offices across time zones review Falcon detections around the clock, including nights, weekends and holidays.

Threat hunting

Regular hunts through Falcon telemetry for activity that did not raise a detection, focused on techniques used against financial institutions.

Pre-approved containment

A containment policy, agreed with you in advance, sets which actions Moraph may take on which machines without waiting for a call back.

Branch-aware policies

Prevention, update and containment settings set by host group, so teller workstations, back-office PCs and core or payment servers are treated differently.

Sensor coverage checks

Every day, the machines reporting to Falcon are compared with your asset inventory, and missing or stale sensors are raised.

Ransomware prevention settings

Falcon's behavioral prevention for ransomware and exploitation is moved from detect-only to blocking after a review with your IT team.

Detection tuning

Recurring false positives from banking applications and IT tools are tuned out with exclusions that you approve and that are reviewed periodically.

Incident reports

Each incident is documented with its timeline, affected machines, actions taken and open questions, ready for your notification decision.

Escalation and on-call

Severity-based escalation to your named contacts by phone and email, with each call and decision recorded.

Sensor update management

Sensor versions staged through pilot groups before reaching all machines, with critical servers updated in windows you approve.

Exam and audit evidence

Coverage, detections, incidents, containment actions and policy changes assembled for examiners and internal audit on request.

Monthly service review

Detections, incidents, hunts, coverage and recommendations reviewed with your security lead each month.

Integrations

How it connects to your systems

Connects toHowWhat flows
Endpoints and serversThe Falcon sensor on Windows, macOS and Linux workstations and servers, including teller and branch machines, deployed with your IT team.In: endpoint telemetry and detections.
Asset inventoryYour configuration management or asset system, so coverage checks compare Falcon against what you own.In: asset list with location and owner.
Identity providerSingle sign-on for console users, and identity context for investigations where you share it.In: user identity and group membership.
Your SIEM or log platformFalcon detections and incident records forwarded to the SIEM you run, so endpoint events sit alongside other security logs.Out: detections, incidents and actions.
Ticketing and on-callIncidents and requests raised in your IT service management tool, and escalations through your on-call arrangements.Out: incidents and requests. In: acknowledgments and decisions.
Moraph Security Awareness TrainingWhere you use both services, phishing reported by staff can be investigated on the endpoints involved.In: reported messages linked to affected users and hosts.
Moraph Vulnerability ManagementWhere you use both services, exposure information informs hunting and incident scoping.In: vulnerabilities by host.

Each integration is confirmed in discovery and specified in the design. See how an engagement progresses.

Security and privacy

How your data is protected

Single sign-on

Your staff and Moraph's analysts sign in to the console through identity providers with multi-factor authentication.

Role-based access

Analysts, service managers and your own staff hold only the console roles their work needs.

Logged response actions

Every containment, remote response and policy change is recorded with the person, time and approval behind it.

Controlled privileged access

Remote response on your machines is limited to the investigation at hand, with credentials staff cannot use without explicit, time-bound authorization.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. CrowdStrike's own platform assurance reports are available from CrowdStrike under its terms.

Data residency

Telemetry is held in the CrowdStrike cloud region selected for your institution, and Moraph's service records stay in the United States, United Kingdom or Australia region you choose.

Company-wide controls, independent audits (SOC 2 Type II and ISO/IEC 27001) and data residency are described in our Trust Center, where you can request the evidence pack.

Reporting

What you can report on

11 standard reports, grouped by who uses them. Each shows who it is for, how it can be broken down, how it is delivered and what it is used for. The data behind them is also available to your own reporting tools.

Operations

Detection triage log

For security lead

Every detection, the analyst's decision, the evidence and the time from detection to decision.

Break down by
Severity, Host group, Technique, Decision
Delivered as
Live view; weekly email summary
Used for
Seeing what Falcon caught and how each detection was handled.

Incident register

For security lead, risk and compliance

Each incident with severity, affected machines, actions taken, who approved them, and status.

Break down by
Severity, Host group, Status, Period
Delivered as
Live view; monthly PDF
Used for
Tracking incidents to closure and supporting notification decisions.

Containment actions

For security lead and client IT

Machines contained, processes stopped and files quarantined, with whether each was under the agreed rules or separately approved.

Break down by
Action, Host group, Approval route, Date
Delivered as
Live view; monthly PDF
Used for
Checking that actions followed the containment policy.

Coverage and posture

Sensor coverage

For security lead and client IT

Machines in your inventory compared with machines reporting to Falcon, with missing, stale and unmanaged hosts listed.

Break down by
Location, Host group, Operating system, Sensor status
Delivered as
Daily email of gaps; monthly PDF
Used for
Closing coverage gaps before they matter.

Policy and exclusion review

For security lead

Prevention, update and containment settings by host group, and every exclusion with its reason and approver.

Break down by
Host group, Policy, Exclusion, Last reviewed
Delivered as
Quarterly PDF
Used for
Making sure no host group is left in detect-only mode or carries stale exclusions.

Sensor version status

For client IT

Sensor versions in use, machines behind the approved version, and planned update waves.

Break down by
Host group, Version, Update wave
Delivered as
Monthly CSV
Used for
Keeping sensors current without disrupting critical servers.

Hunting

Hunt summary

For security lead

Hunts run in the period, the techniques covered, and findings raised as incidents or tuning.

Break down by
Technique, Host group, Outcome
Delivered as
Monthly PDF
Used for
Showing that the service looks for what did not raise an alert.

Management and audit

Incident report

For security lead, risk, compliance and legal

For one incident: timeline, scope, actions, approvals, open questions and the facts available for a notification decision.

Break down by
Phase, Host, Action
Delivered as
PDF per incident
Used for
Supporting regulatory notification decisions and post-incident review.

Board and committee summary

For management and the board

Coverage, incidents by severity, notable threats and service changes for the period.

Break down by
Period, Severity, Host group
Delivered as
Quarterly PDF
Used for
Board oversight of the information security program.

Monthly service review

For security lead, client IT and Moraph service manager

Detections, incidents, hunts, coverage, changes, CrowdStrike notices and decisions needed.

Break down by
Area, Status, Owner
Delivered as
PDF and review meeting
Used for
Keeping both sides accountable for the service.

Exam evidence pack

For internal audit and examiners

Coverage, monitoring, incidents, policy approvals and the containment policy for the period requested.

Break down by
Period, Area
Delivered as
PDF on request
Used for
Answering exam and audit requests about endpoint monitoring and response.

Exports, access and evidence

  • Detections and telemetry come from Falcon; triage decisions, incidents, approvals and reviews are kept in Moraph's service records. Reports bring both together.
  • Every report can be exported to CSV, and summary and evidence reports to PDF. Scheduled reports go only to the people you name.
  • Incident reports separate what is known from what is still being investigated, so your notification decision rests on confirmed facts.
  • Detections and incidents can also be forwarded to your SIEM for reporting alongside other security data.
  • The dashboards and reports CrowdStrike provides in Falcon remain available to your console users.

Deployment

Where and how it runs

CrowdStrike Falcon, managed by Moraph

CrowdStrike hosts the Falcon platform; Moraph monitors and responds on it for you under a managed service agreement.

Moraph-managed with your existing Falcon subscription

If you already subscribe to Falcon, Moraph can take over monitoring and response, subject to CrowdStrike's terms.

Alongside other Moraph services

Run with Moraph's Vulnerability Management, Security Awareness Training or Privileged Access Management services, so findings are shared between them.

Security controls, independent audits and data residency are set out in our Trust Center. Engagement models and what drives a quotation are on Working with Moraph.

Implementation

What a rollout involves

The general phases are on Working with Moraph. For this product, they involve the following.

Estate and host groups

We agree the machines in scope with your IT team and group them, for example teller workstations, back-office PCs, core and payment servers.

Containment policy and escalation

Your security lead approves which actions Moraph may take on which groups, the severity scheme, and who is called out of hours.

Sensor deployment

Sensors are deployed in waves, starting with a pilot group, through your software distribution tools, and coverage checks are switched on.

Tuning in detect-only mode

Prevention starts in detect-only mode while banking applications and IT tools are observed, and exclusions are approved where needed.

Moving to prevention

Blocking is switched on group by group after review with you, beginning with groups where disruption is easiest to manage.

Handover to service

Escalation paths are tested with your on-call contacts, and the service moves to round-the-clock monitoring with a first monthly review.

Limitations

What it does not do

Worth knowing before you evaluate it.

  • Moraph is not CrowdStrike. Falcon belongs to CrowdStrike, and CrowdStrike's own service commitments, roadmap, maintenance and outages apply to it.
  • Subscriptions are subject to CrowdStrike's terms, and the features available depend on the Falcon modules you license.
  • No endpoint service can guarantee that ransomware or other attacks will be prevented. The service reduces the chance and shortens the time to detect and respond.
  • Machines without a working sensor are not protected or monitored. Keeping sensors deployed is a shared task with your IT team.
  • Moraph acts only within the containment policy you approve; anything else waits for your decision, which can affect how quickly an incident is contained.
  • Restoring systems, backups and business operations after an incident is your institution's responsibility; Moraph supports with investigation.
  • Decisions about regulatory notification, customer notification and law enforcement belong to your institution.
  • The service covers endpoints and servers running the Falcon sensor. Network devices, cloud accounts and email are outside its scope unless covered by another service.

Evaluation checklist

What to test in a demonstration or pilot

Questions worth putting to us, and to any other vendor you are considering.

  1. Draft a containment policy for your host groups and check it fits your branch and server operations
  2. Ask how an overnight detection on a teller workstation would be handled, step by step
  3. Compare your asset inventory with the coverage report from a pilot
  4. Review a sample incident report against what your notification decision would need
  5. Check how exclusions are requested, approved and reviewed
  6. Walk through the responsibilities table with your security, IT and risk leads

Questions

Frequently asked questions

Will Moraph isolate our machines without asking?

Only within the containment policy your security lead approves. A common arrangement allows containment of workstations at high severity and requires a call before anything is done to core or payment servers.

Is this the same as CrowdStrike's own managed services?

No. CrowdStrike offers its own hunting and managed services, which you can license separately. Moraph's service is ours: our analysts, our triage and our reporting, running on Falcon.

Who decides whether an incident must be reported to our regulator?

Your institution does. Moraph provides the incident facts and timeline you need to decide, and supports the decision with evidence.

We already have Falcon. Can Moraph take over monitoring?

Usually, subject to CrowdStrike's terms. We start by reviewing coverage, policies and exclusions and agree a containment policy.

Who owns the data?

Your institution does. Telemetry is held by CrowdStrike under its terms, and Moraph's service records are returned or deleted at the end of the agreement as the contract sets out.

How is it priced?

Falcon subscriptions are priced under CrowdStrike's terms, usually per endpoint and module, and Moraph's managed service is priced separately. See Working with Moraph for what drives a quotation.

Next steps

Evaluate Endpoint Detection & Response

Book a demonstration

See the product working with sample data, focused on your workflows.

Request a demonstration

Request a technical briefing

Architecture, integrations, security and hosting, with our engineers and your technical team.

Request a briefing

Factsheet

This page on two sides, to share with colleagues or add to your evaluation file.

Open the factsheet

Buying through a formal procurement? See How to buy for purchasing routes, accessibility conformance reports and company information. Documentation: Endpoint Detection & Response guides on docs.moraph.com (getting started and security guides are public; setup, administration and integration guides are for client accounts). Support: Endpoint Detection & Response support guide.

Related products