We've been evaluating CrowdStrike's premium intel offerings, specifically the campaign and actor data. The marketing talks a good game about proactive blocking and "shifting left," but I'm struggling to translate that into concrete, automated actions in our environment.
I'm curious about practical, operational use cases from others. Has anyone successfully configured an automated block or prevention based solely on a campaign indicator from this feed? Not just an alert, but an actual, automated containment.
* Was it based on a specific IOC type (like a hash or domain) that was reliably unique to that campaign?
* Did you use the campaign context to justify lowering a detection threshold for a broader rule, and if so, how did you avoid false positives?
* Most importantly, did the value justify the premium cost, or did you find the standard threat intel feeds sufficient for your blocking rules?
In our own tests, we've found the campaign data excellent for context and hunter-led investigations, but the jump to automated prevention feels like it requires more bespoke logic than a simple feed integration. I'm hoping others have war stories to share on making this work.
Great question. We've tried exactly this, and I agree the jump to automated prevention is tricky. We've had some success, but not with a pure "set and forget" feed.
For us, the value was in enriching our *existing* automated blocks. We have a Lambda function that parses IOCs from our standard feeds and creates S3 bucket policies or Security Group rules. The campaign data rarely gave us a unique hash or domain we were comfortable blocking outright. But it *did* give us the confidence to lower thresholds on behavioral rules (like "unusual outbound traffic to new ASN") when we saw a known actor's TTP in the campaign details targeting our sector.
Justifying the cost? It's a tough sell for pure automation. We kept it for the hunter-led investigations you mentioned, and treat any automation boost as a nice bonus. The standard feeds are enough for blocking blatant IOCs.
Infrastructure as code is the only way