Aller au contenu principal

CrowdStrike Falcon Integration

Integrate Noxys with CrowdStrike Falcon to correlate AI interaction events with endpoint detection and response data.

Overview​

This integration enables:

  • AI platform visibility within CrowdStrike Falcon
  • Event correlation between AI and endpoint activities
  • Custom detection rules for AI-related threats
  • Automated response playbooks for policy violations
  • Risk scoring combining AI and endpoint data

Data Flow:

AI Interaction → Noxys API → CrowdStrike API → Falcon Console → Incidents & Detection

Prerequisites​

  • CrowdStrike Falcon with API access
  • CrowdStrike admin credentials
  • Noxys admin role
  • OAuth 2.0 API credentials (API keys)

Step 1: Create CrowdStrike API Credentials​

Register Noxys in CrowdStrike to enable API access.

  1. CrowdStrike Falcon Console → Integrations → API Clients & Keys
  2. Click Create New API Client
  3. Configure:
    • Client name: Noxys AI Firewall
    • Description: "Integration for AI interaction data"
  4. Assign API Scopes:
    • ✓ incidents_write — Create and update incidents
    • ✓ ioc_write — Create IOCs (Indicators of Compromise)
    • ✓ detection_write — Create custom detections
    • ✓ host_read — Read host information
  5. Click Create
  6. Copy Client ID and Client Secret (shown once)

Step 2: Enable in Noxys​

Configure CrowdStrike API integration in Noxys.

  1. Noxys Admin Panel → Integrations → CrowdStrike Falcon
  2. Click Enable Integration
  3. Configure:
FieldValue
Client IDFrom step 1
Client SecretFrom step 1
RegionUS1, US2, EU1, etc. (match your Falcon region)
  1. Click Test Connection
    • Should show: "✓ Successfully connected to CrowdStrike Falcon"
  2. Click Save

Step 3: Configure Event Forwarding​

Select events to forward to CrowdStrike.

  1. Settings → Event Forwarding
  2. Enable:
    • ✓ interaction.policy_violated — Policy violations
    • ✓ interaction.high_risk — High-risk interactions
    • ✓ alert.severity_critical — Critical alerts
  3. Click Save

Step 4: Create IOC Indicators​

Define Indicators of Compromise for AI threats.

  1. CrowdStrike Falcon → Intelligence → Indicators
  2. Create indicator for suspicious platforms:
Value: perplexity
Type: Domain
Source: Noxys
Severity: High
Action: Block
Description: Unvetted AI platform with sensitive data exposure
  1. Repeat for risky platforms:
    • deepseek
    • grok
    • claude.ai (if unapproved)

Step 5: Create Custom Detection Rules​

Build detection rules based on Noxys events.

Rule 1: Blocked Risk Signal on Unauthorized Platform​

  1. CrowdStrike Falcon → Host Assurance → Custom Detections
  2. Click Create Detection Rule
  3. Configure:

Trigger:

event_type == "interaction.policy_violated"
AND platform_id IN ["perplexity", "deepseek", "grok"]
AND classification_count > 0
AND action == "block"

Severity: High

Name: "Blocked sensitive data on unauthorized AI platform"

Response:

  • Create incident
  • Send alert to SOC
  1. Enable

Rule 2: High Volume of Violations from User​

event_type == "interaction.policy_violated"
| stats count by user_id
| where count > 10 in last 1 hour
→ Severity: Medium
→ Create incident for user

Rule 3: Credit Card / Financial Data Exposure​

event_type == "interaction.high_risk"
AND classification_type IN ["CREDIT_CARD", "IBAN", "SSN"]
AND risk_score > 0.8
→ Severity: Critical
→ Auto-isolate host (if configured)

Step 6: Create Incidents​

Noxys automatically creates incidents in CrowdStrike.

  1. CrowdStrike Falcon → Incidents
  2. Filter by Source: Noxys
  3. See incidents like:
    • "Policy violation: Block PII on ChatGPT"
    • "High-risk interaction: Restricted data detected"

Each incident contains:

  • Detection time: When policy was triggered
  • Severity: Based on risk score and action
  • User: Who triggered the interaction
  • Platform: Which AI service
  • Classification: Risk Signals types detected
  • Host: Device running the interaction

Step 7: Create Response Actions​

Set up automated response playbooks.

  1. CrowdStrike Falcon → Response actions
  2. Create playbook for high-risk violations:

Trigger: Incident severity = Critical

Actions:

  1. Isolate host (optional)

  2. Create ticket in IT ticketing system

  3. Send alert to security team

  4. Block process on endpoint (if unsafe to continue)

  5. Enable playbook

Step 8: Monitor Incidents​

Track Noxys-related incidents in Falcon.

  1. Incidents dashboard
  2. Create saved search:
    • Source: Noxys
    • Severity: High, Critical
  3. Monitor daily for trends
  4. Review incidents for:
    • Repeated offenders
    • Vulnerable platforms
    • Data exposure patterns

Advanced: Behavioral Analytics​

Enable CrowdStrike Falcon's behavioral analytics for AI threat detection.

  1. Falcon → Settings → Detection & prevention
  2. Enable:
    • ✓ Machine learning detection
    • ✓ Behavioral analytics
  3. Let Falcon correlate:
    • AI interaction patterns
    • Endpoint process execution
    • Network activity
  4. Falcon automatically creates high-fidelity alerts

Troubleshooting​

Events Not Creating Incidents​

  1. Verify integration is Enabled
    • Settings → Integrations → CrowdStrike
  2. Check event forwarding is configured
    • Settings → Event Forwarding
  3. Verify API credentials are correct
    • Test Connection button should work
  4. Check CrowdStrike scopes allow incident creation
    • Verify incidents_write scope is granted
  5. Review CrowdStrike API logs:
    • Falcon → Integrations → API activity

Incidents Not Detected​

  1. Verify custom detection rules are Enabled
  2. Test rule with manual test incident
  3. Check rule logic:
    • Run query in Falcon to verify syntax
    • Test with sample event
  4. Verify rule severity threshold is appropriate

High Latency​

  1. Check API rate limits:
    • CrowdStrike may throttle requests
    • Implement exponential backoff in Noxys
  2. Optimize event volume:
    • Only forward critical events
    • Filter out noisy events

Integration with Response Playbooks​

CrowdStrike Response playbooks can use Noxys data.

Example Playbook: Credential Exposure Response

Trigger: Noxys event with classification=EMAIL or SSN

Playbook Steps:
1. Check if user has MFA enabled
2. Force password reset
3. Clear sessions
4. Send notification to user
5. Create ticket for security team
6. Monitor user for 24 hours
  1. CrowdStrike Falcon → Response → Playbooks
  2. Create playbook using Noxys event data
  3. Automate response workflow

Compliance & Audit​

Monitor integration health:

  1. CrowdStrike Falcon → Integrations → Activity
  2. Review:
    • API call success rate
    • Errors encountered
    • Data volume
  3. Export logs for compliance audit

Cost Considerations​

  • CrowdStrike Falcon: License required (typically $50-200/device/year)
  • Noxys CrowdStrike integration: Included, no additional cost
  • API calls: Included in Falcon subscription (fair use limits apply)

Best Practices​

  1. Forward only critical events:

    • Focus on policy_violated and high_risk
    • Skip routine interaction.created events

  2. Create targeted detection rules:

    • One rule per threat type
    • Test with historical data first
    • Monitor for false positives

  3. Use incident categorization:

    • Tag incidents by platform (ChatGPT, Claude, etc.)
    • Tag by data type (PII, financial, etc.)
    • Simplifies filtering and reporting

  4. Set up alerting:

    • Alert on critical incidents immediately
    • Daily summary of high-severity incidents
    • Weekly trends report

  5. Monitor playbook effectiveness:

    • Track manual vs. automated responses
    • Measure MTTR (Mean Time To Respond)
    • Optimize playbooks based on metrics

Disabling Integration​

If you need to disable CrowdStrike integration:

  1. Integrations → CrowdStrike Falcon → Disable
  2. No more incidents are created
  3. Existing incidents remain in CrowdStrike
  4. Data is not deleted

To re-enable:

  1. Follow configuration steps again
  2. Verify API credentials are still valid
  3. Events resume flowing to CrowdStrike

Support & Resources​

PII alert mapping (Noxys signal -> Falcon incident)​

Noxys signals map to Falcon incident severity at the connector layer. The mapping ships as a default and is editable in Noxys Console -> Integrations -> CrowdStrike Falcon -> Severity mapping.

Noxys classificationNoxys severityFalcon incident severityFalcon tactic / technique
CREDIT_CARD, IBAN, SSNCRITICALCritical (4)Exfiltration / Data Transfer Size Limits (T1030)
SECRET (API key, token)CRITICALCritical (4)Credential Access / Unsecured Credentials (T1552)
EMAIL (bulk)HIGHHigh (3)Collection / Data from Information Repositories (T1213)
IP (confidential)HIGHHigh (3)Collection / Email Collection (T1114)
CODE (proprietary)MEDIUMMedium (2)Collection / Data from Local System (T1005)
SHADOW_AI (unvetted platform)MEDIUMMedium (2)Command and Control / Web Service (T1102)

The Noxys event body is preserved in the incident details.custom_data.noxys field, so Falcon Fusion workflows can branch on classification, platform_id, and user_sub without re-querying Noxys.

Host isolation via Real-Time Response​

Falcon supports network containment ("isolate host"). Noxys does not isolate by default — it raises the incident and lets your SOC click the action, or lets a Fusion workflow do it for you. Two supported paths:

  1. Falcon Console -> Workflows -> Create workflow
  2. Trigger: Incident -> Updated, filter incident.source == "Noxys" AND incident.severity >= 4
  3. Action: Contain host -> target incident.devices[0].device_id
  4. Optional follow-up: Notify (email, Slack), Create case in ITSM
  5. Save and enable

Noxys ships the device AID via the device_id field on the incident — Falcon resolves it natively, no extra mapping needed.

Path B: Noxys-driven push (advanced)​

Enable this only after 30 days of manual-mode operation and a written runbook.

  1. Noxys Console -> Integrations -> CrowdStrike Falcon -> Advanced
  2. Toggle Push host isolation on CRITICAL alerts
  3. Confirm the OAuth client has hosts:write scope (re-create the API client if needed)

Noxys then calls:

POST https://api.crowdstrike.com/devices/entities/devices-actions/v2?action_name=contain
Authorization: Bearer <oauth-token>
Content-Type: application/json

{
  "ids": ["<falcon-aid-resolved-from-noxys-hostId>"]
}

A successful response (202 Accepted) flips the Noxys alert state to contained and writes an audit row.

Test it​

# Inject a synthetic CRITICAL alert into Noxys (staging tenant)
curl -X POST https://api-staging.noxys.cloud/v1/alerts/test \
  -H "Authorization: Bearer $NOXYS_ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "severity": "CRITICAL",
    "classification": "CREDIT_CARD",
    "platform_id": "perplexity",
    "user_sub": "test-user@corp.eu",
    "host_id": "<your-test-device-aid>"
  }'

Expected within 60 seconds:

  • Incident appears in Falcon Console -> Incidents, source = Noxys, severity = Critical
  • Fusion workflow (if enabled) contains the test host
  • Noxys alert state moves to contained