Containment from the files to the endpoint.

Helm sees ransomware in the files it encrypts, including attacks your endpoint agent never sees. With the CrowdStrike integration, Helm can place the hosts involved into Falcon network containment and send every action into Falcon, so your team works from one picture.

Attackers increasingly encrypt from places an endpoint agent cannot reach. An unmanaged laptop, a contractor’s device or a valid session that looks legitimate. Helm doesn’t depend on where the attack starts. It reads what is happening to the files, detects encryption in under a second and acts on fixed rules your team can read.

CrowdStrike Falcon is a cloud-native security platform built on endpoint detection and response (EDR), with a single lightweight agent on each device. On Windows file servers that run the sensor, its File System Containment can also block remote ransomware, once switched on. Falcon protects the host. Helm protects the data, wherever the attack comes from.

When Helm contains an attack, it can find the host involved in Falcon and place it in network containment through the CrowdStrike API, and disable the user account in Active Directory or Entra ID at the same time. Each event, with the user, host, IP address, affected files and the action taken, can also flow into Falcon Next-Gen SIEM, so your analysts see Helm’s actions beside Falcon’s own detections.

Where a device has no Falcon sensor, Helm still contains the compromised account and keeps it away from your data.

Helm adds the signal from your data and acts on it, while the endpoint protection you already run keeps doing its job. If some of your devices run Microsoft Defender, Helm contains through Defender too.

See all integrations, or talk to us about adding Helm to your CrowdStrike environment.