Enrich Falcon anomaly detection with CLEAR1 identity verification data

This integration brings CLEAR1 identity verification session data into Falcon Next-Gen SIEM, where analysts can correlate it alongside endpoint and identity events. Teams can evaluate unusual patterns in a user’s verification behavior, location, device, or access activity. This gives investigators a historical identity signal that helps surface threats that may look benign in isolation.

• Add identity context to investigations
  Ingest CLEAR1 verification session data into Falcon Next-Gen SIEM alongside existing security events
• Correlate identity and endpoint data
  Search identity verification records alongside endpoint, identity, and other security telemetry in one unified view
• Support threat investigations
  Use historical CLEAR1 identity verification context—including verification behavior, location, device, and access data—to help analysts evaluate suspicious patterns and inform response decisions