CrowdStrike + F5: Extending detection and response to the network layer

Chris StewartVice President, Global Cloud and Technology Alliance Partners | CrowdStrike

Cybersecurity is most effective when partners work together.

At CrowdStrike, we believe strong technology alliances are essential to helping customers reduce blind spots, extend protection across environments, and stop breaches faster. That belief is central to how we approach our ecosystem—and it’s at the core of our partnership with F5.

As a Select member of the F5 Application Delivery and Security Platform (ADSP) Partner Program, CrowdStrike is working with F5 to extend detection and response to critical network infrastructure. By deploying the CrowdStrike Falcon® sensor on F5 BIG-IP systems, organizations can bring real-time monitoring and response capabilities to the network layer—an increasingly important part of today’s attack surface.

The network is part of the modern attack surface

Security teams have made significant progress protecting endpoints, cloud workloads, and identities. But attackers don’t operate within neat boundaries—and neither can defenders.

Network infrastructure plays a foundational role in modern enterprise environments. Technologies like F5 BIG-IP manage application traffic, enforce policies, and help ensure performance and availability. Because of their strategic position, these systems can also become attractive targets for sophisticated adversaries.

When network infrastructure is compromised, attackers may attempt to:

• Move laterally across environments
• Manipulate traffic flows or configurations
• Establish persistence within infrastructure components
• Operate outside the visibility of endpoint-only security tools

As attacks grow more automated and AI-assisted, organizations are working to eliminate gaps across the entire attack surface—including the network layer.

Bringing detection and response to F5 BIG-IP

Through the CrowdStrike and F5 integration, organizations can deploy the Falcon sensor on BIG-IP systems. This extends CrowdStrike’s detection and response capabilities beyond traditional endpoints and into network infrastructure.

Telemetry from BIG-IP is analyzed within the Falcon platform, allowing security teams to monitor activity on these systems and correlate it with signals from endpoints, cloud workloads, and identities. By bringing infrastructure visibility into a unified console, teams gain broader context for investigating and responding to threats.

This integration enables organizations to:

• Gain real-time visibility into BIG-IP system activity
• Detect suspicious behavior and anomalous processes
• Correlate infrastructure telemetry with activity across endpoints and cloud environments
• Leverage managed threat hunting to proactively identify advanced threats

Rather than treating network infrastructure as a separate domain, this approach brings it into a cohesive detection and response strategy.

Reducing blind spots through partnership

Security leaders today are navigating increasingly complex, hybrid environments. Disconnected point solutions can create fragmented visibility, slowing investigation and response when every minute matters.

The collaboration between CrowdStrike and F5 helps to address this challenge by integrating infrastructure telemetry into a broader, cross-domain security picture. For customers operating across data centers, private cloud, and public cloud environments, unified visibility is becoming essential.

From my perspective leading global cloud and technology alliances at CrowdStrike, the most impactful partnerships are those that improve customer outcomes in meaningful ways. F5 plays a critical role in application delivery and security for enterprises worldwide. By integrating the Falcon platform with BIG-IP, we’re helping organizations extend protection to a foundational layer of their infrastructure.

Cybersecurity is a team effort. When leading platforms align with a shared focus on stopping breaches, customers benefit from deeper visibility, faster response, and greater resilience across their environments.

To learn more about how CrowdStrike and F5 are extending detection and response to the network layer, explore our joint solution overview.

Also, be sure to check out the blog post announcing the F5 ADSP Partnership Program.

About the Author

Chris StewartVice President, Global Cloud and Technology Alliance Partners | CrowdStrike

More blogs by Chris Stewart