CrowdStrike Falcon Platform Modules — Identity, Cloud, Exposure & Next-Gen SIEM

① Platform vs point products — one agent unlocks many modules

Start with the big idea: Falcon is a platform, not a single product. The same lightweight agent and the same cloud you already learned about become the foundation for a whole family of modules. You do not install a new agent per capability; you switch on a subscription.

A point product is a separate tool for one job — one vendor for endpoints, another for identity, another for cloud, another for the SIEM — each with its own agent, console, data store and bill. A platform collapses that: one agent, one console and one data fabric shared by every module, so they see the same telemetry and reinforce each other.

The interview line: buy capabilities, not tools. Because the modules share data, an endpoint signal can sharpen an identity detection, a cloud finding, and a SIEM alert — something disconnected point products simply cannot do.

② Falcon Identity Protection — ITDR for Active Directory and Entra ID

Falcon Identity Protection brings ITDR to the platform. Most modern breaches abuse valid credentials, so this module watches your identity stores — on-prem Active Directory and cloud Microsoft Entra ID — for risky behaviour: anomalous logins, lateral movement, pass-the-hash, suspicious privilege use and shadow or stale accounts.

What it adds beyond endpoint

It baselines normal identity behaviour and can trigger risk-based conditional access — for example, stepping a risky user up to multi-factor or blocking the action outright. In 2026 CrowdStrike extended this with Falcon Privileged Access (taming standing privilege in AD and Entra ID) and FalconID, phishing-resistant MFA delivered from the platform.

The point: identity and endpoint live in one console and share telemetry, so a compromised laptop and a suspicious login are correlated together — not investigated in two separate tools.

③ Falcon Cloud Security — a full CNAPP, agentless plus sensor

Falcon Cloud Security is a CNAPP: it unifies the cloud security jobs that point vendors keep apart. It combines two styles of coverage. Agentless scanning reads your cloud provider APIs to find misconfigurations, risky entitlements and exposed assets without installing anything — this is CSPM (posture) and CIEM (who-can-do-what permissions).

Posture plus runtime

For workloads that are actually running — VMs, containers, serverless — the same Falcon sensor provides CWPP (runtime workload protection) and CDR (cloud detection and response), stopping live attacks, not just listing risks. Newer pieces like ASPM and DSPM extend it to application and data posture.

The interview line: agentless tells you what is risky; the sensor stops what is happening. A CNAPP gives you both in one console, and because it shares the platform's data fabric, a cloud finding lines up with the endpoint and identity picture.

④ Exposure Management & Next-Gen SIEM — see risk, then see everything

Falcon Exposure Management answers 'where are we exposed and what do we fix first?' It does risk-based vulnerability management (RBVM), attack-surface management (CAASM) and asset inventory using the existing sensor and Threat Graph — no separate scanner fleet. Its ExPRT.AI prioritisation predicts which vulnerabilities attackers are most likely to exploit, so a tiny team fixes the few that matter instead of chasing thousands.

The single source of truth for events

Falcon Next-Gen SIEM is the platform's analytics and logging layer, built on Falcon LogScale. It ingests Falcon telemetry and third-party logs (firewalls, cloud, even other EDRs like Microsoft Defender) for fast, index-free search, correlation and detection — the modern replacement for a legacy SIEM.

Tie it together: every module writes into one data fabric, so the SIEM already holds the endpoint, identity, cloud and exposure signal. That shared data is the whole platform payoff — you license capabilities, not yet another disconnected tool.