Buy with AWS

CrowdStrike Falcon® for AWS Pay-As-You-Go FAQs

CrowdStrike Falcon® for AWS Pay-As-You-Go helps organizations quickly protect their AWS environments while being billed monthly as part of your AWS invoice.
Buy with AWS

FAQs

Overview

CrowdStrike Falcon® for AWS Pay-As-You-Go helps organizations quickly protect their AWS environments while being billed monthly as part of your AWS invoice. CrowdStrike Falcon® for AWS has two product offerings:

  • CrowdStrike Falcon® Cloud Security Runtime delivers agent-based workload protection for your cloud instances, container clusters, and managed containers to automatically detect, investigate, and respond to threats in real-time.

  • CrowdStrike Falcon® Next-Gen SIEM ingests and correlates multi-vendor security events, simplifies investigation and search, and provides 13 month data retention.

Subscribing to Falcon for AWS enables customers to use any combination of the listed pay-as-you-go products.

Onboarding

mmediately after subscribing on AWS Marketplace, there are a few more steps to complete before you can begin using your product.

1 - Provide subscriber details

Your Falcon platform account and products cannot be provisioned until you submit the registration form associated with the account linking step after clicking “Set up your account” on the CrowdStrike Falcon® for AWS Pay-As-You-Go listing. The email address you provide is granted the Falcon Administrator role for your Falcon account, and will receive periodic support emails and technical announcements. Choose that address carefully. You may set up identity federation, create additional users, and assign roles after your initial log in. Within a few minutes of submitting the registration form, you will receive a confirmation email including next steps. If you don’t receive this email within 15 minutes, please contact CrowdStrike Pay-As-You-Go support at [email protected].

2 - Tenant and product provisioning

Once we receive the registration submission, we begin provisioning your new tenant and preparing your Pay-As-You-Go products for usage. Upon completion of the tenant provisioning (which takes several minutes) you will receive an activation email with instructions for logging on to the Falcon console. While you wait for your Pay-As-You-Go products to be ready for use, you may set up identity federation, create additional users, and assign roles. It can take as little as 15 minutes and in some cases up to several hours for your products to be ready for onboarding. When that process completes, you will receive a third email indicating that your products are ready, along with a link back to AWS Marketplace to continue with automated data onboarding and further instructions for getting started with CrowdStrike Falcon® Next-Gen SIEM and CrowdStrike® Falcon Cloud Security Runtime.

After completing the registration form, tenant provisioning begins and you'll receive an activation email with console login instructions within ~5 minutes. While you can immediately log in and set up users, identity federation, and roles, it can take anywhere from 15 minutes to several hours for your Pay-As-You-Go products to be fully ready for use. You'll receive a final email when products are ready, along with next steps for automated data onboarding. If you don't receive the initial confirmation email within 15 minutes, please contact [email protected].

If you haven't received your welcome email within 15 minutes of completing the registration form after your AWS Marketplace subscription, please contact [email protected]. Be sure to check your spam folder and verify you provided the correct email address during registration.

Official CrowdStrike communications will come from @crowdstrike.com email domains. If you're not receiving expected emails, please check your spam folder and ensure your email system allows messages from the crowdstrike.com domain.

To determine which cloud region to select when logging into the CrowdStrike Customer Center, check the URL you use to access your Falcon console:

  • US-1: If your URL is https://falcon.crowdstrike.com
  • US-2: If your URL is https://falcon.us-2.crowdstrike.com
  • EU: If your URL is https://falcon.eu-1.crowdstrike.com

You'll need to select the matching cloud region during the Customer Center login process.

Billing and Usage

You are billed monthly through your AWS invoice for actual usage:

  • CrowdStrike Falcon® Next-Gen SIEM – charged per gigabyte of data ingested, including 13-month retention. 
    • Note: Data is only retained for active subscriptions and discontinues if a user unsubscribes.
    • For example, assuming a flat rate of $5.95/GB and actual ingest of 100GBs in one month, AWS invoice at end of month= $5.95 * 100GBs = $595
  • CrowdStrike Falcon® Cloud Security Runtime – charged per active sensor-hour for running workloads.

Usage metrics are posted daily to AWS and summarized in the AWS Cost and Usage Report. Charges stop automatically when sensors are uninstalled or data connectors are disabled. 

See https://aws.amazon.com/marketplace/pp/prodview-vubjuepxztndi for pricing details.

An annual CrowdStrike subscription is ideal for organizations seeking greater cost predictability as well as the following advantages: Advantages include:

  • Access to additional modules: Easily add modules across endpoint, identity, and cloud and more.
  • Additional service offerings: Eligibility for managed detection and response (Falcon Complete) and other services.
  • Dedicated account management: Direct relationship with CrowdStrike’s sales, success, and technical teams.

Can I convert from Pay-As-You-Go to an annual subscription later?

Yes. You can easily transition to an annual subscription at any time without redeploying sensors or losing data. Email [email protected] to discuss conversion options and available discounts.

Yes. You can easily transition to an annual subscription at any time without redeploying sensors or losing data. Email [email protected] to discuss conversion options and available discounts.

Support and Resources

You can access training through CrowdStrike University. To navigate there, click the Support Quick Links button in the upper right hand of the Falcon Console, then click Support Portal, then click CrowdStrike University.