Endpoint Detection & Response

Moraph resells, implements and runs CrowdStrike Falcon as a managed service across teller workstations, back-office PCs and servers at banks, credit unions and other financial firms. Falcon watches every endpoint for malicious behavior and blocks known threats; Moraph's analysts, working follow-the-sun from our offices, triage detections, hunt for activity that slipped past, and contain affected machines under rules you approve. Your security lead decides on anything beyond those rules, and you keep a full record of each incident.

The problem it solves

Branch and back-office workstations run all day, connect to the core banking system and payment applications, and are a common way in for ransomware and credential theft. Most community and regional institutions cannot staff a security operations team around the clock, so endpoint alerts raised overnight or at weekends wait until someone is in. Agents are deployed but not every machine reports, prevention policies are left in detect-only mode, and nobody has time to hunt for activity that did not raise an alert. When an incident does happen, notification clocks start running before the facts are known.

Who it’s for

• Chief information security officers and information security officers at banks and credit unions
• IT leaders responsible for branch, teller and back-office workstations
• Risk and compliance leaders who answer for incident response and notification
• Infrastructure teams who run core banking, payment and file servers
• Internal audit and examiners, who need evidence of monitoring and response

1. Deploy and coverMoraph deploys the Falcon sensor across your estate with your IT team, sets prevention and update policies by host group, and checks every day that every machine you own is reporting.
2. Detect and triageFalcon raises detections from endpoint behavior. Moraph analysts review each one around the clock, decide whether it is malicious, and record the evidence and decision.
3. HuntMoraph analysts search Falcon telemetry for signs of attack that did not raise a detection, such as unusual remote access tools, credential dumping or staging of data, focusing on techniques used against financial institutions.
4. Contain and recoverUnder a containment policy you approve in advance, Moraph analysts can isolate a machine from the network, stop a process or quarantine a file using Falcon. Anything outside that policy goes to your security lead first.

Around-the-clock triage

Moraph analysts in offices across time zones review Falcon detections around the clock, including nights, weekends and holidays.

Threat hunting

Regular hunts through Falcon telemetry for activity that did not raise a detection, focused on techniques used against financial institutions.

Pre-approved containment

A containment policy, agreed with you in advance, sets which actions Moraph may take on which machines without waiting for a call back.

Branch-aware policies

Prevention, update and containment settings set by host group, so teller workstations, back-office PCs and core or payment servers are treated differently.

Sensor coverage checks

Every day, the machines reporting to Falcon are compared with your asset inventory, and missing or stale sensors are raised.

Ransomware prevention settings

Falcon's behavioral prevention for ransomware and exploitation is moved from detect-only to blocking after a review with your IT team.

Detection tuning

Recurring false positives from banking applications and IT tools are tuned out with exclusions that you approve and that are reviewed periodically.

Incident reports

Each incident is documented with its timeline, affected machines, actions taken and open questions, ready for your notification decision.

Escalation and on-call

Severity-based escalation to your named contacts by phone and email, with each call and decision recorded.

Sensor update management

Sensor versions staged through pilot groups before reaching all machines, with critical servers updated in windows you approve.

Exam and audit evidence

Coverage, detections, incidents, containment actions and policy changes assembled for examiners and internal audit on request.

Monthly service review

Detections, incidents, hunts, coverage and recommendations reviewed with your security lead each month.

Security lead

Approves policies and containment rules, decides on incidents and notification

On-call contact

Receives escalations out of hours and authorizes actions beyond the agreed rules

Client IT administrator

Deploys sensors, maintains the asset inventory and restores affected machines

Moraph security analyst

Triages detections, hunts, and contains machines under the agreed rules

Moraph service manager

Runs the service relationship, reviews and change approvals

Auditor or examiner (read-only)

Views evidence of monitoring and response without changing anything

Endpoints and servers

The Falcon sensor on Windows, macOS and Linux workstations and servers, including teller and branch machines, deployed with your IT team.

Asset inventory

Your configuration management or asset system, so coverage checks compare Falcon against what you own.

Identity provider

Single sign-on for console users, and identity context for investigations where you share it.

Your SIEM or log platform

Falcon detections and incident records forwarded to the SIEM you run, so endpoint events sit alongside other security logs.

Ticketing and on-call

Incidents and requests raised in your IT service management tool, and escalations through your on-call arrangements.

Moraph Security Awareness Training

Where you use both services, phishing reported by staff can be investigated on the endpoints involved.

Moraph Vulnerability Management

Where you use both services, exposure information informs hunting and incident scoping.

Single sign-on

Your staff and Moraph's analysts sign in to the console through identity providers with multi-factor authentication.

Role-based access

Analysts, service managers and your own staff hold only the console roles their work needs.

Logged response actions

Every containment, remote response and policy change is recorded with the person, time and approval behind it.

Controlled privileged access

Remote response on your machines is limited to the investigation at hand, with credentials staff cannot use without explicit, time-bound authorization.

Independent audits

Moraph's operations are audited under SOC 2 Type II and ISO/IEC 27001. CrowdStrike's own platform assurance reports are available from CrowdStrike under its terms.

Data residency

Telemetry is held in the CrowdStrike cloud region selected for your institution, and Moraph's service records stay in the United States, United Kingdom or Australia region you choose.

CrowdStrike Falcon, managed by Moraph

CrowdStrike hosts the Falcon platform; Moraph monitors and responds on it for you under a managed service agreement.

Moraph-managed with your existing Falcon subscription

If you already subscribe to Falcon, Moraph can take over monitoring and response, subject to CrowdStrike's terms.

Alongside other Moraph services

Run with Moraph's Vulnerability Management, Security Awareness Training or Privileged Access Management services, so findings are shared between them.

Estate and host groups

We agree the machines in scope with your IT team and group them, for example teller workstations, back-office PCs, core and payment servers.

Containment policy and escalation

Your security lead approves which actions Moraph may take on which groups, the severity scheme, and who is called out of hours.

Sensor deployment

Sensors are deployed in waves, starting with a pilot group, through your software distribution tools, and coverage checks are switched on.

Tuning in detect-only mode

Prevention starts in detect-only mode while banking applications and IT tools are observed, and exclusions are approved where needed.

Moving to prevention

Blocking is switched on group by group after review with you, beginning with groups where disruption is easiest to manage.

Handover to service

Escalation paths are tested with your on-call contacts, and the service moves to round-the-clock monitoring with a first monthly review.

• Moraph is not CrowdStrike. Falcon belongs to CrowdStrike, and CrowdStrike's own service commitments, roadmap, maintenance and outages apply to it.
• Subscriptions are subject to CrowdStrike's terms, and the features available depend on the Falcon modules you license.
• No endpoint service can guarantee that ransomware or other attacks will be prevented. The service reduces the chance and shortens the time to detect and respond.
• Machines without a working sensor are not protected or monitored. Keeping sensors deployed is a shared task with your IT team.
• Moraph acts only within the containment policy you approve; anything else waits for your decision, which can affect how quickly an incident is contained.
• Restoring systems, backups and business operations after an incident is your institution's responsibility; Moraph supports with investigation.
• Decisions about regulatory notification, customer notification and law enforcement belong to your institution.
• The service covers endpoints and servers running the Falcon sensor. Network devices, cloud accounts and email are outside its scope unless covered by another service.

• Draft a containment policy for your host groups and check it fits your branch and server operations
• Ask how an overnight detection on a teller workstation would be handled, step by step
• Compare your asset inventory with the coverage report from a pilot
• Review a sample incident report against what your notification decision would need
• Check how exclusions are requested, approved and reviewed
• Walk through the responsibilities table with your security, IT and risk leads