Endpoint Detection & Response

Principal workflows

• Deploy and cover: Moraph deploys the Falcon sensor across your estate with your IT team, sets prevention and update policies by host group, and checks every day that every machine you own is reporting.
• Detect and triage: Falcon raises detections from endpoint behavior. Moraph analysts review each one around the clock, decide whether it is malicious, and record the evidence and decision.
• Hunt: Moraph analysts search Falcon telemetry for signs of attack that did not raise a detection, such as unusual remote access tools, credential dumping or staging of data, focusing on techniques used against financial institutions.
• Contain and recover: Under a containment policy you approve in advance, Moraph analysts can isolate a machine from the network, stop a process or quarantine a file using Falcon. Anything outside that policy goes to your security lead first.

Who uses it

• Chief information security officers and information security officers at banks and credit unions
• IT leaders responsible for branch, teller and back-office workstations
• Risk and compliance leaders who answer for incident response and notification
• Infrastructure teams who run core banking, payment and file servers
• Internal audit and examiners, who need evidence of monitoring and response

Reporting

• Detection triage decisions with evidence
• Incident register and per-incident reports
• Containment actions and their approval route
• Daily sensor coverage against your inventory
• Policy, exclusion and sensor version reviews
• Hunt summaries and board reporting

Features

• Around-the-clock triage: Moraph analysts in offices across time zones review Falcon detections around the clock, including nights, weekends and holidays.
• Threat hunting: Regular hunts through Falcon telemetry for activity that did not raise a detection, focused on techniques used against financial institutions.
• Pre-approved containment: A containment policy, agreed with you in advance, sets which actions Moraph may take on which machines without waiting for a call back.
• Branch-aware policies: Prevention, update and containment settings set by host group, so teller workstations, back-office PCs and core or payment servers are treated differently.
• Sensor coverage checks: Every day, the machines reporting to Falcon are compared with your asset inventory, and missing or stale sensors are raised.
• Ransomware prevention settings: Falcon's behavioral prevention for ransomware and exploitation is moved from detect-only to blocking after a review with your IT team.
• Detection tuning: Recurring false positives from banking applications and IT tools are tuned out with exclusions that you approve and that are reviewed periodically.
• Incident reports: Each incident is documented with its timeline, affected machines, actions taken and open questions, ready for your notification decision.
• Escalation and on-call: Severity-based escalation to your named contacts by phone and email, with each call and decision recorded.
• Sensor update management: Sensor versions staged through pilot groups before reaching all machines, with critical servers updated in windows you approve.
• Exam and audit evidence: Coverage, detections, incidents, containment actions and policy changes assembled for examiners and internal audit on request.
• Monthly service review: Detections, incidents, hunts, coverage and recommendations reviewed with your security lead each month.

Integrations

• Endpoints and servers: The Falcon sensor on Windows, macOS and Linux workstations and servers, including teller and branch machines, deployed with your IT team.
• Asset inventory: Your configuration management or asset system, so coverage checks compare Falcon against what you own.
• Identity provider: Single sign-on for console users, and identity context for investigations where you share it.
• Your SIEM or log platform: Falcon detections and incident records forwarded to the SIEM you run, so endpoint events sit alongside other security logs.
• Ticketing and on-call: Incidents and requests raised in your IT service management tool, and escalations through your on-call arrangements.
• Moraph Security Awareness Training: Where you use both services, phishing reported by staff can be investigated on the endpoints involved.
• Moraph Vulnerability Management: Where you use both services, exposure information informs hunting and incident scoping.

Deployment

• CrowdStrike Falcon, managed by Moraph: CrowdStrike hosts the Falcon platform; Moraph monitors and responds on it for you under a managed service agreement.
• Moraph-managed with your existing Falcon subscription: If you already subscribe to Falcon, Moraph can take over monitoring and response, subject to CrowdStrike's terms.
• Alongside other Moraph services: Run with Moraph's Vulnerability Management, Security Awareness Training or Privileged Access Management services, so findings are shared between them.

Security and privacy

• Single sign-on: Your staff and Moraph's analysts sign in to the console through identity providers with multi-factor authentication.
• Role-based access: Analysts, service managers and your own staff hold only the console roles their work needs.
• Logged response actions: Every containment, remote response and policy change is recorded with the person, time and approval behind it.
• Controlled privileged access: Remote response on your machines is limited to the investigation at hand, with credentials staff cannot use without explicit, time-bound authorization.
• Independent audits: Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. CrowdStrike's own platform assurance reports are available from CrowdStrike under its terms.
• Data residency: Telemetry is held in the CrowdStrike cloud region selected for your institution, and Moraph's service records stay in the United States, United Kingdom or Australia region you choose.

Limitations

• Moraph is not CrowdStrike. Falcon belongs to CrowdStrike, and CrowdStrike's own service commitments, roadmap, maintenance and outages apply to it.
• Subscriptions are subject to CrowdStrike's terms, and the features available depend on the Falcon modules you license.
• No endpoint service can guarantee that ransomware or other attacks will be prevented. The service reduces the chance and shortens the time to detect and respond.
• Machines without a working sensor are not protected or monitored. Keeping sensors deployed is a shared task with your IT team.
• Moraph acts only within the containment policy you approve; anything else waits for your decision, which can affect how quickly an incident is contained.
• Restoring systems, backups and business operations after an incident is your institution's responsibility; Moraph supports with investigation.
• Decisions about regulatory notification, customer notification and law enforcement belong to your institution.
• The service covers endpoints and servers running the Falcon sensor. Network devices, cloud accounts and email are outside its scope unless covered by another service.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/endpoint-detection-and-response. Purchasing routes and company information: www.moraph.com/how-to-buy.