Strong tooling, but agree your update policy in writing
4.0/5overall, average of the five axes
Deployment effort4
Support quality4
Features vs promises5
Pricing transparency3
Return on investment4
What happened
We run Falcon in a 24/7 SOC and the telemetry is what makes the shift work. After the July 2024 content update incident we rewrote our agent update policy entirely: sensor versions are now staged N-1 with a canary ring, and we asked for the same treatment of content channels. The answer we got was honest about what is and is not staged, which I appreciated more than a reassurance would have been.
Worked well
Telemetry depth. RTR is a genuine incident response tool, not a checkbox. API is well documented and stable.
Did not
Content channel updates are not under customer control in the way sensor versions are. Ask about this explicitly during procurement rather than assuming.
6 found this helpful