A security analyst using CrowdStrike Falcon Cloud Workload Protection (CWP) notices unusual outbound traffic from a Kubernetes pod to an unknown external IP. The analyst needs to determine whether the traffic is malicious and identify the process responsible for the connection. Which CrowdStrike Falcon feature should the analyst use to identify network connections at the process level?

The CrowdStrike Falcon sensor, which is the core technology behind Cloud Workload Protection (CWP), provides deep, real-time visibility into endpoint and workload activity. A key feature is its ability to monitor all network connections and associate them directly with the originating process, user, and parent process. For a Kubernetes pod, this allows an analyst to immediately see which specific process inside the container initiated the suspicious outbound traffic, view its full command-line arguments, and analyze the entire process tree for context, directly addressing the analyst's need.

A. Falcon LogScale: This is a log management and observability platform. While it can ingest network data, it is used for analysis and search, not for generating the primary process-to-network telemetry.
B. Falcon Identity Protection: This module focuses on protecting against identity-based attacks and credential misuse. It does not provide visibility into network connections originating from specific processes.
D. Falcon Sandbox: This is an automated malware analysis tool for detonating suspicious files in an isolated environment. It is not used for real-time monitoring of live production workloads like a Kubernetes pod.

1. CrowdStrike, "Falcon for Cloud Workload Protection" (Solution Brief), Page 2.

"Falcon provides complete visibility into the security posture of your cloud-native stack... Monitor all container activity including file access, network connections and process execution." This document confirms that monitoring network connections at the process level is a core capability of CWP.

2. CrowdStrike, "Falcon Platform: Technical Specifications" (Data Sheet), Page 1, "Visibility" section.

"Unprecedented real-time and historic visibility across your enterprise... including process creation, driver loads, registry modifications, disk access, memory access, and network connections." This specifies that the Falcon sensor, the engine for CWP, directly captures network connection events tied to processes.

3. CrowdStrike, "Cloud Workload Protection with the CrowdStrike Falcon Platform" (White Paper), Page 5, "Runtime Protection" section.

"The Falcon sensor provides deep runtime visibility into container execution... This includes visibility into all processes, file system activity, and network communications." This source explicitly links the Falcon sensor's function within CWP to providing visibility into network communications at runtime.