I built PocketSOC - a mobile app to triage and respond to CrowdStrike alerts faster

Hi all,

I’ve spent a good part of my career working in security operations, and one thing that always bugged me was getting Falcon alerts when I wasn’t near a laptop. If you’re on call or away from your desk, even something simple like triaging an alert or isolating a host can take longer than it should.

Over the past year I built a mobile app called PocketSOC to make that easier.

The idea is to give SOC teams a way to quickly see and respond to alerts from their phone without needing to log into the console from a computer.

Some of the things the app supports today:

- Push notifications when new CrowdStrike alerts arrive

- Search and filtering for Falcon detections

- A process graph view that shows the Falcon-style process tree

- Ability to contain a host or lift containment directly from mobile

- On-call schedules so notifications only fire during your shift

There’s also a portal that supports CrowdStrike Enterprise APIs for managing users and organization policies tied to the mobile app.

On the security side we added a few things organizations usually ask for:

- Screenshot protection

- Biometric / PIN authentication requirements

- Jailbreak / root detection

- Clipboard protection

PocketSOC also supports a few other platforms (depending on configuration), including:

- Microsoft Defender for Endpoint

- Microsoft Defender for Cloud

- AWS GuardDuty

- Splunk (enterprise environments)

The Android version is now live on the Play Store, and the iOS version is currently awaiting App Store approval.

If anyone here wants to take a look, the Android app is here:

https://play.google.com/store/apps/details?id=app.weavehub.pocketsoc

One important note: PocketSOC was independently developed and is not affiliated with or endorsed by CrowdStrike.