EDR Integration Overview

Noxys is an AI Firewall, not an endpoint agent. When Noxys detects a high-severity event (PII exfiltration toward an unvetted AI platform, secret leakage, repeated policy violations from a single user), the response surface lives on the endpoint: kill a session, isolate the host, force re-auth. We don't reinvent that surface — we feed the alert into the EDR you already operate so your SOC keeps a single console for triage.

This page is the story. The per-vendor pages give you the click-by-click install.

• CrowdStrike Falcon — OAuth2 API client, IOC + custom detection rule, Real-Time Response lockdown.
• Microsoft Defender for Endpoint — Azure AD App registration with Machine.Isolate, Graph Security API alert ingest, isolation via WDATP API.

Why route Noxys alerts into your EDR

Capability	Noxys alone	Noxys + EDR
Detect AI policy violation (PII, secrets, IP)	Yes	Yes
Map alert to the actual host / logged-in user	Partial (browser fingerprint + SSO sub)	Yes — EDR resolves device ID
Quarantine browser tab	Yes (extension)	Yes
Isolate host from the network	No	Yes (EDR action)
Kill malicious process	No	Yes (EDR action)
Correlate with endpoint telemetry (PowerShell, parent process)	No	Yes
Single SOC console for triage	No	Yes

The EDR owns endpoint response. Noxys owns AI-layer detection. Together you get a closed loop: detect at the browser, contain at the host.

End-to-end flow

The arrows that matter for procurement: arrow 3 (Noxys -> EDR) is what this integration ships. Arrow 7 (EDR webhook back into Noxys) closes the loop and updates the alert timeline so the SOC sees containment without leaving Falcon / Defender.

PII alert mapping

Noxys classifies risk signals into a fixed taxonomy (platform/pii-detection). Each signal maps to an EDR severity so your SOC's existing triage rules keep working.

Noxys Risk Signal	Example value	EDR severity	Recommended response
CREDIT_CARD	4111 1111 1111 1111	Critical	Isolate host, force password reset
IBAN	FR76 3000 6000 ...	Critical	Isolate host, notify finance lead
SSN / national ID	1 85 02 75 ...	Critical	Isolate host, DPO notification (GDPR Art. 33 timer starts)
EMAIL (bulk: > 50 in 1h)	many.users@corp.eu	High	Quarantine browser, force MFA re-prompt
SECRET (API key, OAuth token)	sk-..., xoxb-...	Critical	Isolate host, rotate detected secret
CODE (proprietary source)	repo path + AST hit	Medium	Coach user, log, no isolation
IP / confidential doc	"Project Eos roadmap"	High	Quarantine tab, alert IP owner
SHADOW_AI (unvetted platform)	perplexity, deepseek	Medium	Block via extension, IOC in EDR

The full taxonomy and detection logic lives at PII Detection. The per-EDR page documents the exact field mapping (Noxys event JSON -> Falcon incident schema / Defender alert schema).

Host isolation: trigger paths

There are three supported paths from a Noxys alert to an isolated host. Pick one — don't run all three or you'll get duplicate quarantines.

1. Manual (default) — Noxys ships the alert into the EDR console, SOC analyst clicks "Isolate". Recommended for the first 30 days while you tune false-positive rates.
2. EDR-side automation — A Falcon custom detection rule or a Defender automated investigation playbook fires on Noxys alerts with severity == CRITICAL and runs the isolation action. Recommended after tuning.
3. Noxys-driven (push) — Noxys calls the EDR isolation API directly via the integration's service principal. Only enable on tenants with a written runbook and on-call rotation; misfires cost real money.

The per-vendor pages document the exact API call:

• Falcon: POST /devices/entities/devices-actions/v2 with action_name=contain and the device AID resolved from the Noxys hostId.
• Defender: POST https://api.securitycenter.microsoft.com/api/machines/{id}/isolate with IsolationType=Full and the device ID resolved via the Graph Security API.

Install order

1. Stand up the API credentials on the EDR side (5 min per vendor — pages linked above).
2. Add the connector in Noxys Console -> Settings -> Integrations -> EDR.
3. Test alert injection with the documented curl sample.
4. Tune severity mapping (default mapping above is a starting point — most tenants raise EMAIL to High after week 1).
5. Enable host isolation (manual first, automation later).

Time to first incident in the EDR console: under 15 minutes if your EDR admin and your Noxys admin are on the same call.

Troubleshooting

• Connector test fails with 401 — OAuth token scope is wrong. Falcon needs incidents_write + detection_write + hosts_write (for isolation). Defender needs SecurityAlert.ReadWrite.All + Machine.Isolate.
• Alerts arrive in EDR but no host attached — Noxys couldn't resolve the device. Check that the Noxys browser extension has device fingerprinting enabled (it's on by default after v0.6) and that the user's session is tied to an Entra ID / Okta SSO sub.
• Isolation fires twice — You enabled both EDR-side automation and Noxys-driven push. Pick one.
• Defender alert appears under "Other" category — Set the category field to SuspiciousActivity in the connector advanced settings.
• Falcon IOC not blocking — IOC platform must be set to windows,mac,linux explicitly. Default is windows only.

Related

• CrowdStrike Falcon
• Microsoft Defender
• Microsoft Sentinel — SIEM-side companion (alert correlation, not response)
• HarfangLab — European EDR
• Webhooks API — Custom forwarder if your EDR isn't listed