Most engineers think…
Most people assume that once you install a good EDR, the tool catches everything automatically and the job is done. In an interview and in a real SOC, that assumption gets you breached.
The best adversaries go hands-on-keyboard and live off the land — using legitimate tools so they never trip a clean signature. That is why Falcon pairs automated detection with Falcon OverWatch, a managed team of human threat hunters who proactively search the telemetry around the clock. When something is found, an analyst works the detection — mapped to MITRE ATT&CK — against the clock of the 1-10-60 rule, then uses network containment and Real Time Response (RTR) to isolate and clean the host. Knowing this human + tooling loop is what separates someone who 'has an EDR' from someone who can actually stop a breach.
① Hunting vs detecting — why OverWatch exists
Start with the distinction that interviewers love: detection is automated, hunting is proactive and human-led. Automated detection fires an alert when behaviour matches a known-bad pattern or an indicator of attack. Threat hunting assumes some attacker already slipped past the automation and goes looking for them.
Falcon OverWatch is CrowdStrike's managed threat-hunting service: a dedicated team of elite human hunters who watch the telemetry 24/7, looking for stealthy, hands-on-keyboard intrusions that blend in with normal activity. They lean on the platform's scale — OverWatch sifts through roughly 6.2 trillion events a day — and deep adversary knowledge to spot the faint signals automation alone would miss.
The key idea: hunters catch the attacker who is living off the land with legitimate tools. When OverWatch finds something, they escalate it to your team as a detection with context, so your analysts can respond. It is a force multiplier on top of the tooling, not a replacement for it.
In an interview, define them cleanly: automated detection fires on known patterns and IOAs, while OverWatch is managed human hunting that proactively chases the stealthy, living-off-the-land attacker the automation can miss. Naming both — and why you need both — shows you understand defence in depth.
What is the core difference between Falcon OverWatch and automated detection?
② Working a detection — triage, the chain and MITRE ATT&CK
However an alert arrives — automated or hunter-raised — an analyst has to work the detection. In the Falcon console the detection is not a lone line item: it is presented as an attack chain showing the process tree, the parent and child processes, command lines, network connections and files touched, so you can read the story of what happened.
Why MITRE ATT&CK matters here
Each step is mapped to the MITRE ATT&CK framework — a shared catalogue of adversary tactics and techniques. So instead of a vague 'suspicious PowerShell', the analyst sees labelled steps like Initial Access ▸ Execution ▸ Persistence ▸ Lateral Movement. That common vocabulary lets the whole team triage faster and hand off cleanly.
Triage answers three questions: is it real (true vs false positive), how far has it gone (scope), and what does the chain tell me to do next. CrowdStrike's detections are strong enough here that Falcon scored 100% detection in the 2025 MITRE ATT&CK Enterprise Evaluation — but a human still decides the response.
CrowdStrike's managed threat-hunting team — human hunters who proactively search the telemetry 24/7 for stealthy, hands-on-keyboard attacks and escalate them as detections.
Each step of a detection is labelled with the attacker's tactic and technique, giving analysts a shared vocabulary to read the attack chain and triage fast.
The response benchmark: detect in 1 minute, investigate in 10, contain and remediate in 60 — set against an eCrime breakout time now measured in minutes.
A secure remote shell into the live endpoint from the console — investigate, pull forensics, kill processes, remove persistence and run remediation scripts.
Falcon detections are mapped to which framework so analysts share a common vocabulary?
③ The 1-10-60 rule and containing the host
Response has a clock. CrowdStrike's 1-10-60 rule is the benchmark: detect in 1 minute, investigate in 10 minutes, and contain and remediate in 60 minutes. Hit those and you usually stop a breach before it spreads; miss them and the attacker wins.
The reason is breakout time. CrowdStrike's 2025 Global Threat Report put the average eCrime breakout time at about 48 minutes, with the fastest recorded at 51 seconds. That is your real deadline — the response must beat the attacker's lateral movement.
Network containment — isolate, but keep control
The fastest way to buy time is network containment (host isolation). One click in the console cuts the host off from the network so it cannot spread — yet it still talks to the Falcon cloud, so you keep full management and can keep investigating. You can pre-whitelist a few admin IPs so critical tools still reach a contained host, and you lift containment with one click once the host is clean.
Pulling the plug destroys volatile evidence (running processes, memory, network state) and tips off the attacker. Use network containment instead: it isolates the host from the network but keeps it talking to the Falcon cloud, so you preserve the live system for RTR investigation and remediation.
Why is network containment a smart first move when a host looks compromised?
④ Real Time Response — the remote shell for live IR
Containment stops the bleeding; Real Time Response (RTR) lets you operate. RTR is a secure remote shell into the live endpoint, run from the Falcon console, so an analyst can investigate and remediate without physically touching the machine — even when it is contained, because RTR rides the same cloud channel.
What you do over RTR depends on your role. A read-only responder can browse files, list processes and pull memory or artefacts for forensics. An Active Responder can also kill processes, delete files and edit the registry. An RTR Administrator can additionally put files onto the host and run custom scripts and executables — for example a saved PowerShell runscript to remove a persistence mechanism. These roles are deliberately tiered so power is granted carefully.
From one host to the whole fleet
The same actions scale: using the API (or Falcon Fusion automation), an IR team can run an RTR remediation across many hosts at once — kill the malware, remove persistence, collect evidence — turning a single analyst's fix into a fleet-wide response. That is how teams actually hit the 60-minute remediation target.
Priya, a SOC analyst in Hyderabad, faces this
At 2am OverWatch escalates a detection: a finance laptop is running PowerShell that pulled a tool and is now probing other machines on the subnet.
An attacker phished the user, is hands-on-keyboard, and has started lateral movement — the chain shows Execution then Discovery in the MITRE ATT&CK labels.
Open the detection, read the process tree and ATT&CK mapping to confirm it is a true positive and see how far it has spread; breakout has already started, so the clock is on.
Falcon console ▸ Endpoint detections ▸ select host ▸ Network contain, then Connect to host (RTR)Network-contain the laptop to stop the lateral movement, then use RTR to kill the malicious process, remove the persistence (scheduled task), and pull artefacts for evidence.
Re-check the host: no new outbound probing, the scheduled task is gone, the chain shows no further activity — then lift containment after confirming it is clean.
Never lift containment on a hunch. After RTR remediation, re-read the detection chain, confirm the malicious process and persistence are gone, and check for no new suspicious activity. Only then lift containment — and keep watching the host for a while afterwards.
▶ Watch an IR team stop a hands-on-keyboard attack
How a hunter-raised detection becomes a contained, remediated host. Press Play for the healthy path, then Break it to see the classic failure.
An IR analyst needs to kill a malicious process and remove a persistence mechanism on a live, contained host. What do they use?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why does CrowdStrike pair managed hunting (OverWatch) with RTR and the 1-10-60 rule instead of relying on automated detection alone? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Falcon OverWatch
- CrowdStrike's managed threat-hunting service — human hunters who proactively search telemetry 24/7 for stealthy, hands-on-keyboard attacks and escalate them as detections.
- Threat hunting
- Proactively searching for attackers who have already evaded automated detection, rather than waiting for an alert to fire.
- Indicator of Attack (IOA)
- A behaviour-based signal of malicious intent (e.g. a document spawning PowerShell to download a payload), as opposed to a static file hash.
- MITRE ATT&CK
- An industry-standard framework of adversary tactics (goals) and techniques (methods) that Falcon detections are mapped to for a shared vocabulary.
- Attack chain
- The console view of a detection as a process tree with command lines, network and file activity, so the analyst can read the story of the attack.
- 1-10-60 rule
- CrowdStrike's IR benchmark — detect in 1 minute, investigate in 10, contain and remediate in 60 — to beat the attacker's breakout time.
- Breakout time
- How long after the first foothold an intruder takes to move laterally to a second host; CrowdStrike's 2025 report put the eCrime average near 48 minutes.
- Network containment
- Isolating a host from the network with one click so it cannot spread, while it still communicates with the Falcon cloud for management and investigation.
- Real Time Response (RTR)
- A secure remote shell into the live endpoint from the console — investigate, pull forensics, kill processes, delete files, remove persistence and run scripts.
- RTR Administrator
- The highest RTR role: can put files onto a host and run custom scripts/executables, on top of killing processes and deleting files.
📚 Sources
- CrowdStrike — Falcon Adversary OverWatch: managed threat hunting across all attack surfaces (24/7 human hunters, ~6.2T events/day). crowdstrike.com/platform/threat-intelligence/adversary-overwatch
- CrowdStrike Blog — The 1/10/60 Minute Challenge: a framework for stopping breaches faster. crowdstrike.com/resources/crowdcasts/the-1-10-60-minute-challenge
- CrowdStrike — 2025 Global Threat Report: average eCrime breakout time ~48 minutes, fastest 51 seconds. crowdstrike.com/global-threat-report
- CrowdStrike Blog — How to defend against threats with Falcon Fusion and Falcon Real Time Response (RTR). crowdstrike.com/blog/how-to-defend-against-threats-with-falcon-fusion-and-falcon-real-time-response
- CrowdStrike Blog — CrowdStrike achieves 100% in the 2025 MITRE ATT&CK Enterprise Evaluation; ATT&CK mapping in the Falcon console. crowdstrike.com/blog/crowdstrike-achieves-100-percent-2025-mitre-attack-enterprise-evaluation
- CrowdStrike / Falcon docs & FalconPy — Network containment and Real Time Response roles (Active Responder, RTR Administrator: put/run, runscript). falconpy.io/Service-Collections/Real-Time-Response-Admin
What's next?
Got hunting and response? Next, go deep on the detection engine itself — how Falcon's NGAV and EDR decide what is malicious using machine learning, indicators of attack (IOAs) and behavioural analytics before a human ever sees the alert.