SOMPO Holdings: Between alerts and management decisions

SOMPO Holdings presented how they utilize CrowdStrike's detection information to inform their business decisions.
This initiative involves not simply relaying detected alerts, but combining them with asset registers and information on the impact on the business, transforming them into a format that is easier for management to understand and make decisions about.
In addition, examples of AI-powered report generation and decision support applications were shared.
How do we present information obtained from the field of security to senior management? This session focused on "How to present information to upper management," which was also the theme of this Meetup.

BookLive: To what extent should we entrust Falcon Complete to you?

BookLive presented a case study showcasing their use of Falcon Complete.
Through sharing actual operational experiences and incident response anecdotes, participants shared strategies for efficiently maintaining operations even with a small team.
Among the questions raised were, "To what extent should we delegate responsibilities?" and "What should our company keep track of?"
The discussion touched upon the challenges that arise from using Falcon Complete, and how to integrate the service into a company's operations.

TOTO: Security operations and ITDR utilization in a global environment

TOTO presented their security operations in a global environment and case studies of ITDR utilization.
In addition to the operational structure including overseas locations, initiatives combining multiple modules were shared, such as asset management and vulnerability management utilizing Discover and Spotlight, and protection of the authentication infrastructure through ITDR.
Various perspectives were presented as examples of expanding the scope of CrowdStrike's use while simultaneously enhancing its operational sophistication.

AI utilization and Charlotte Online AI

As the use of generative AI and AI agents progresses,

• How to use AI safely
• What can you do with Charlotte AI?
• How to utilize AI in SOC operations

This demonstrated a high level of interest in these topics.
The focus is not on introducing AI itself, but rather on how to utilize it in daily security operations.

Operational efficiency improvements and utilization of NG-SIEM

Many challenges were raised, such as "Should we implement SIEM?", "How can we reduce the operational burden?", and "How can we make the SOC more efficient?".
In particular, NG-SIEM and Complete for NG-SIEM were discussed in multiple tables.
How can we increase efficiency while keeping the workload down as we continue operations?
This appears to be a common problem for many companies.

ITDR, asset management, vulnerability management

There was also interest in countermeasures against attacks targeting authentication infrastructure, as well as asset visibility and vulnerability management using Discover and Spotlight.
Security operations are not limited to endpoints.
How should we define the scope of what needs to be protected, including IDs and asset management?
The results suggest that interest among fund managers is spreading.

You can easily ask questions about things you'd like to know.

"How are other companies handling this setting?"
"How do you deal with alerts like this?"
Some questions that arise during daily operations cannot be answered by product documentation alone. Falcom provides a platform where users can share these questions with each other and pool their knowledge.

A wide variety of community-exclusive events are available.

In addition to Meetups like this one, we regularly organize study sessions and seminars for community members, such as "FalconTech," a CTF-style event where participants learn how to use Falcon.
In addition to listening to case studies, we provide opportunities for users to talk with each other and learn practically.

Content for users immediately after implementation is also available.

Immediately after installing Falcon, you may encounter difficulties with the setup process. FalconCom provides videos and documentation to help resolve common setup questions that users often encounter after installation.
This community is also available to users who are just starting to use the service.

The greatest appeal of Falcomi is that it allows user companies to exchange real-world operational knowledge and tips with each other. You'll find colleagues you can immediately consult with about any questions you have, and opportunities for in-depth learning at events. If you're interested in using Falcon more or learning about other companies' cases, why not join Falcomi?