CrowdStrike EDR and XDR: Falcon Insight Features, Pricing and Limits

CrowdStrike sells its EDR under three names at once, so the first job in any evaluation is working out whether "Falcon Insight", "Falcon Insight XDR" and "CrowdStrike EDR" describe one product or three. This guide decodes the module, walks through what it does on a working day, prices the tier it ships in, and compares it with the EDR that comes bundled inside an RMM stack. Prices, ratings and test results are dated as of November 2026.

TL;DR

• CrowdStrike EDR is Falcon Insight XDR. A Falcon sensor module that records endpoint activity, detects attacks from behaviour and responds through Real Time Response.
• It ships in Falcon Enterprise. $184.99 per device a year in November 2026; Go and Pro stop at antivirus.
• XDR is included. Identity, cloud and mobile telemetry correlate in one console, plus 10GB a day of free ingest.
• It is not an RMM. Patching, IT scripting and ticketing stay in the operations stack.

What CrowdStrike EDR Is: Falcon Insight XDR, Decoded

The answer to "is CrowdStrike an EDR?" is yes, and the EDR has a product name: Falcon Insight XDR. It began as Falcon Insight, the endpoint detection and response module that records what every process on a host does and flags behaviour that looks like an attack. CrowdStrike added the XDR suffix when it started correlating that endpoint record with telemetry from its other modules, and the data sheet now describes it as unified EDR and native XDR in one product. The name changed. The sensor did not. For the category definitions behind the letters, the endpoint security guide covers EPP, EDR, MDR and XDR.

Four other names appear on the same quote and are worth separating. Falcon Prevent is the next-generation antivirus layer that blocks known and unknown malware before it runs. Falcon OverWatch is CrowdStrike's human threat-hunting team, sold as an add-on. Falcon Complete is the fully managed service, where CrowdStrike's own analysts run Insight on your behalf around the clock. Falcon Fusion is the workflow engine that automates actions across all of them. If you are comparing the whole platform rather than this one module, the Falcon review for MSPs covers the full lineup.

How Detection Works on a Working Day

Insight starts from a continuous record rather than a scan. The sensor streams process executions, command lines, file hashes, network connections and parent-child relationships to the Falcon cloud, where detections fire on indicators of attack: sequences of behaviour that match adversary tradecraft, not a signature of a known file. Each detection lands in the console mapped to the MITRE ATT&CK framework with the affected host, the process tree and the specific indicator that triggered it.

The investigation surface is where practitioners spend most of their time. A G2 reviewer working as a second-line security analyst rated the platform 5 out of 5 on 4 November 2026, and singled out the ability to pivot from a detection into the process tree, identify parent-child relationships and find other affected hosts without switching tools. The same review listed two frictions: the process tree sometimes takes a while to load, and switching the active customer ID in one browser tab changes it in the others, which matters when you investigate several tenants at once. G2 rates the Falcon Endpoint Protection Platform 4.7 out of 5 across 680 reviews as of November 2026.

Two AI layers now sit on top of the detections. CrowdStrike Signal generates leads by correlating related indicators that have not yet crossed a detection threshold, and Charlotte AI runs what the vendor calls agentic detection triage and agentic response: it filters false positives, ranks what is left and proposes step-by-step response actions. CrowdStrike's own four-minute walkthrough shows the full path from a Scattered Spider style intrusion to the incident workbench, with Charlotte AI summarising the attack across endpoint, identity and cloud:

Independent testing backs the detection claims. In the SE Labs October 2025 Enterprise Advanced Security (EDR) Ransomware Test, Falcon scored 100% on detection, protection and legitimate accuracy, blocking or disabling all 649 ransomware files, according to CrowdStrike's write-up of the result. Gartner named CrowdStrike a Customers' Choice in the 2026 Voice of the Customer for Endpoint Protection Platforms and a Leader in the 2026 Magic Quadrant for Endpoint Protection.

Real Time Response: The Part Practitioners Rate Highest

Real Time Response, RTR in every forum thread, is the remote shell inside Insight. An analyst opens a session on any host the sensor can reach, runs built-in commands to list processes, pull files, kill a process or quarantine the host, and runs custom PowerShell or shell scripts for anything the built-ins do not cover. The session works from anywhere, as long as the host is online, which is what lets a small team respond to an incident on an endpoint in another country without a VPN or a site visit.

RTR scales through Falcon Fusion. CrowdStrike's own tech-hub walkthrough on Fusion with Real Time Response shows a workflow that triggers on a detection, runs a script to collect a file's metadata and decides on the next action from the result, with no analyst in the loop. The community PSFalcon PowerShell module runs the same RTR commands across many hosts from a script. Two set-up details catch new teams: the Falcon Administrator role does not include RTR by default, and Windows hosts need a response policy with RTR enabled before a session will open.

The practitioner view on EDR choice in 2026 puts Falcon at the top of the thread and then reframes the question. In a March 2026 r/sysadmin discussion asking what counts as a good detection and response product, the top-voted answer backed Falcon after three deployments and credited the managed SOC with saving the team several times, while another reply argued that Falcon, SentinelOne and Defender are all technically solid and that the difference is the quality of the MDR service behind them:

The Sensor Footprint and How Long the Data Lasts

One sensor carries every Falcon module. The data sheet's claim is that it deploys in minutes with no reboot, and that adding Insight, Spotlight or Falcon for IT later is a licence change rather than a second agent. It runs on Windows, macOS and Linux, with a separate Insight build for ChromeOS. CrowdStrike publishes no CPU or memory figure for the sensor; the reviews on G2 and PeerSpot describe it as light, and the recurring complaint in community threads is the occasional CPU spike on a host producing an unusual volume of events rather than a steady drain.

Retention is the detail to get in writing. The Falcon Data Replicator data sheet states that CrowdStrike keeps a full, unfiltered record from every endpoint for a minimum of seven days, adjustable to the organisation's needs, and Falcon Search Retention is the add-on that extends searchable endpoint, identity and cloud data to months or years. Seven days covers a live incident. It does not cover the question an insurer or a forensics firm asks about an intrusion discovered in week five, so decide at purchase time whether the longer window is part of the quote.

Where the XDR Comes From: Native Sources and Free Ingest

XDR in CrowdStrike's definition means correlating the endpoint record with first-party telemetry from the other Falcon modules: identity (Falcon Identity Protection), cloud workloads, mobile devices, threat intelligence, vulnerability data from Spotlight and data protection. The data sheet states that every EDR customer gets native XDR at no additional cost. In practice that means a detection can show the compromised credential and the cloud API call next to the process tree, provided you run those modules. If you run only Insight, the XDR view contains endpoint data.

Third-party data enters through Falcon Next-Gen SIEM. Insight XDR customers receive 10GB a day of free third-party ingest with over 100 one-click connectors and parsers, so firewall, identity provider and email gateway logs can land in the same console without a separate SIEM licence. Above 10GB a day, or beyond the base retention, Next-Gen SIEM becomes a quoted line. For where XDR stops and a SIEM begins, the EDR vs XDR guide draws the line in terms an insurer recognises.

CrowdStrike EDR Pricing: Which Tier Switches Insight On

Insight XDR is not sold alone on the public price list. It arrives with Falcon Enterprise, the third of three published tiers, and everything above Enterprise is quoted. The tiers below it are next-generation antivirus without the detection and response record, which is the distinction that decides whether a cyber insurance questionnaire gets a yes.

Prices are read from CrowdStrike's pricing page in November 2026. Monthly billing costs more: $19.99 a month for Enterprise is $239.88 a year, 30% above the annual price. OverWatch managed hunting, Falcon Search Retention, Identity Protection, Spotlight and Falcon for IT are all add-ons or quoted modules, so a quote for "CrowdStrike EDR" at 250 endpoints starts at $46,248 a year for Enterprise and grows by module before it grows by device. The free trial runs 15 days without a card.

Falcon Insight vs the EDR Inside an RMM Bundle

The alternative on an MSP's desk is rarely another standalone EDR. It is the EDR the RMM vendor bundles or resells, often with an MDR service wrapped around it, billed on the same invoice as monitoring and patching. The comparison comes down to four things: how deep the record goes, who watches it, what it costs per endpoint, and how many consoles the technician opens.

On depth, Falcon's record and its RTR shell are the reason it sits at the top of practitioner threads, and the SE Labs result above is the independent evidence. On who watches it, Insight alone is a tool for a team that reads detections; the managed layer is Falcon Complete at a quoted price, or a third-party MDR. On consoles, Insight is its own console, with API connectors into RMM and PSA tools. A bundled EDR trades some depth for a single pane and a single bill. What an MDR layer adds to either choice is covered in what MDR is.

The overlap question comes up where a client already pays for Microsoft 365 E5. An April 2026 r/cybersecurity thread from a team running Falcon as primary on about 400 Windows and Mac endpoints, with Defender for Endpoint Plan 2 sitting unused in the E5 licence, drew 40 comments. The top answer called paying for both a waste and said two previous employers had moved off Falcon to save the money; others kept Falcon as primary with Defender in passive mode and noted the connector that feeds Defender XDR data into Falcon. Three of the four companies one commenter had worked at ran exactly that configuration:

The maths for a 250-endpoint fleet, all figures from the November 2026 price lists cited in this post. Falcon Enterprise is $46,248 a year. The EDR portion of that, the step from Pro to Enterprise, is $85 per device, or $21,250 a year: that is the price of the detection record, RTR and threat intelligence inside CrowdStrike. Add an operations layer and the total moves little: OpenFrame, the open AI-native layer that runs its own RMM, is published at $1 per device a month with 10 million AI tokens a month included (July 2026 pricing), so Enterprise plus OpenFrame is $49,248 a year, with the RMM at $3,000 of it. The decision is therefore about the security line on its own terms, not about whether the operations layer can absorb it. Flamingo builds OpenFrame, which competes with some of the tools covered here.

What Insight Does Not Cover

Falcon Insight XDR records, detects and responds. It does not deploy third-party patches, run scheduled maintenance scripts for IT, manage software inventory for a client report or open the ticket. CrowdStrike sells patching and IT automation as Falcon for IT, a separate module on the same sensor, and the comparison between that module and an RMM is a post of its own. RTR can run a script on a host during an incident; it is not a scheduling engine for the Tuesday reboot.

That boundary is useful rather than limiting. It means the security team's tool and the operations team's tool can be chosen on their own merits, as long as the two talk to each other: a detection that opens a ticket, a host containment that pauses monitoring alerts, an asset record that both consoles agree on. The endpoint management software roundup covers the operations side of that pairing.

Who It Fits, and Who Should Look Elsewhere

Falcon Insight XDR fits a team that will read its detections, or will pay someone to: an internal security function, an MSP with a SOC or an MDR partner, or any organisation whose insurer has asked for EDR by name. It fits best where the other Falcon modules are already in play, because that is when the XDR correlation shows something the endpoint record alone cannot. It fits a mixed Windows, macOS and Linux estate with one sensor to maintain.

It is a weaker fit for a 30-endpoint client where nobody will open the console, where the detection and response budget is better spent on a managed service that includes the agent, or where Defender for Endpoint is already licensed and staffed. In those cases the stack guide at MSP security stack shows how the layers fit.

The short answer: CrowdStrike EDR is Falcon Insight XDR, it starts at Falcon Enterprise, the XDR correlation and 10GB a day of ingest come included, and the record it keeps is the reason practitioners rank it first. Decide the retention window and the managed layer before you sign, and keep the operations stack on its own terms beside it.

Keywords: crowdstrike edr, crowdstrike falcon edr, crowdstrike xdr, crowdstrike falcon xdr, falcon insight, falcon insight xdr, crowdstrike falcon insight xdr, falcon edr, falcon xdr, falcon prevent, crowdstrike falcon prevent, is crowdstrike an edr, crowdstrike endpoint detection and response, crowdstrike edr features and capabilities, crowdstrike falcon endpoint protection platform, crowdstrike endpoint protection