Summary

• CrowdStrike and Dynatrace introduced three integrations at Fal.Con Europe on 2 November, connecting the Falcon platform with Dynatrace's observability and log management capabilities.
• Federated search, shared operational context, and Bindplane telemetry routing allow organisations to investigate security activity across their existing systems.
• The integrations are available immediately, although the effect on investigation times and data costs will depend on individual deployments.

CrowdStrike and Dynatrace have introduced three integrations connecting cybersecurity investigations with application and infrastructure monitoring, allowing organisations to examine threats across their existing technology platforms while gaining greater control over the movement and storage of operational data.

The partnership, unveiled at Fal.Con Europe in Barcelona on 2 November, connects CrowdStrike’s Falcon security platform with Dynatrace’s observability and log management technology. The integrations are available immediately and cover federated searches, the correlation of security and application information, and flexible routing of logs and other telemetry.

Security and infrastructure teams frequently work with different information about the same incident. Endpoint security software may detect suspicious activity on a server, while application monitoring systems record service failures, changing performance, and dependencies between the affected system and other business services.

Investigating what happened requires those observations to be connected. Organisations have traditionally addressed part of that requirement by collecting security information within centralised platforms, although the volume of data generated by modern applications and infrastructure can make storage, processing, and access increasingly expensive.

Investigating incidents across existing systems

The first integration allows CrowdStrike Falcon to perform federated searches across information held within Dynatrace. Security analysts can query relevant application, infrastructure, and log telemetry without first copying the complete underlying dataset into the security platform.

Federated search provides an alternative to transferring large volumes of operational information into another repository whenever investigators need to examine a possible security event. The information can remain within its existing platform, with authorised searches returning the records necessary for the investigation.

This approach can be useful where organisations already operate separate systems for security monitoring and application observability. Both platforms may contain substantial historical information, but only a small proportion of those records may be relevant when investigating a particular incident.

Removing unnecessary duplication can reduce some data movement and associated processing costs, although federated searches still consume resources. The commercial outcome will depend on the pricing arrangements, query volumes, information retention policies, and integration requirements of the systems involved.

Investigators must also understand how data from separate platforms relates to the same event. An endpoint identifier, application name, network address, or timestamp may need to be associated with records collected through a different system before the information can support a reliable conclusion.

The integration is intended to make that correlation easier by giving security analysts access to operational context without requiring them to abandon the tools already used for threat investigation.

Connecting security alerts with service performance

The second integration brings CrowdStrike endpoint detection and response information into Dynatrace. Security findings can be analysed alongside application logs, infrastructure dependencies, and performance measurements, helping operational teams understand whether suspicious activity has affected a business service.

For example, an endpoint detection may identify malicious behaviour on a server supporting an important application. The security team can investigate the activity through Falcon, while operations personnel examining service performance in Dynatrace may see associated changes in availability, response times, or infrastructure behaviour.

Connecting those observations could help teams determine whether a service interruption resulted from malicious activity, an ordinary technical fault, or a combination of events. It may also provide a clearer understanding of which applications depend on an affected system and where containment measures could create further disruption.

Modern applications frequently operate across cloud services, containers, databases, and externally managed infrastructure. A customer-facing outage may involve several components, making it difficult to establish the sequence of events without information about how the services depend on one another.

Observability platforms maintain records of those relationships to support performance monitoring and troubleshooting. Adding endpoint security information gives investigators another source of evidence when examining failures or unusual system behaviour.

The integration does not remove the need to validate the underlying evidence. A performance change occurring at the same time as a security alert does not necessarily establish that one caused the other, while incomplete telemetry can obscure important parts of an incident.

Routing telemetry according to its purpose

The third integration uses Bindplane, Dynatrace’s telemetry management technology, to control where logs and other operational information are delivered. Organisations can route security events to CrowdStrike, application and performance data to Dynatrace, or selected information to both systems.

This creates greater flexibility than a model in which every record is automatically copied into multiple monitoring platforms. Security teams may require certain events for threat detection, while infrastructure teams need different information to investigate application performance and capacity.

Routing information according to its intended use can help organisations manage the cost of collecting and retaining telemetry. It may also allow existing monitoring investments to remain useful when additional security capabilities are introduced.

Data selection requires careful governance because records excluded from one platform may later become relevant to an investigation. Organisations need to decide what information must be retained, which systems should hold it, and how investigators can retrieve historical evidence when necessary.

Those decisions will differ across applications and regulatory environments. Security information associated with financial systems or essential services may be subject to retention and access requirements that are not identical to those governing ordinary application performance data.

Bindplane provides mechanisms for controlling telemetry pipelines, but the responsibility for deciding which records are required remains with the organisation operating the systems.

Security and operations share more evidence

The integrations reflect a closer relationship between security operations and the teams responsible for maintaining application availability. Both functions increasingly depend on information about the same infrastructure, although they may use it to answer different questions.

A security analyst investigating unauthorised access needs to establish what an attacker attempted, which systems were affected, and whether the activity remains ongoing. An operations engineer may be concerned with service availability, the effect of system changes, and the steps necessary to restore normal performance.

Combining their evidence can help coordinate those investigations, particularly when containment measures affect production infrastructure. Isolating a compromised server may prevent further malicious activity while also interrupting an application that depends on it.

Shared information cannot independently resolve those operational trade-offs. Organisations still need clear responsibilities for approving changes, conducting investigations, and determining when systems can safely return to service.

CrowdStrike and Dynatrace are also deploying one another’s technologies within their own environments, providing an operational application of the partnership beyond the integrations being offered commercially.

In Europe, organisations using the services will need to consider how operational information is accessed and processed across jurisdictions. Keeping records within an existing platform may assist with certain data management requirements, but federated access does not automatically establish that every processing activity complies with a customer’s contractual or regulatory obligations.

The agreement is separate from CrowdStrike’s expansion of Project QuiltWorks, which concentrates on identifying and remediating vulnerabilities. The Dynatrace integrations address the information available during investigations and the infrastructure required to manage that information.

With the three integrations now available, customers can connect security detection, application observability, and telemetry management through their existing platforms. Their deployment will determine whether the shared information improves investigations and whether more selective data movement reduces the operational costs associated with maintaining those systems.