Skip to main content
The CrowdStrike Falcon connector searches the endpoint telemetry your Falcon sensors already send to Falcon Next-Gen SIEM (NG-SIEM). Falcon knows which process on which device looked up an AI service’s domain, so findings show the client tool, such as Claude Code, Cursor, or a browser, as well as the user and the device. Each AI service then appears in your Shadow AI discovery findings, counted in active hours. Openlayer reaches the Falcon API over outbound HTTPS. Nothing needs to reach Openlayer.
This page covers Shadow AI discovery. To import prompts and tool calls from AI coding agents with Falcon Guardian, see CrowdStrike Falcon Guardian. The two connect separately.
The CrowdStrike connector is turned on separately from Shadow AI discovery. If it isn’t in the Connectors dialog, reach out to us to turn it on.

​
What Openlayer reads

  • DNS requests your Falcon sensors recorded for the domains of AI services in the catalog, grouped by device, process, and hour.
  • The process behind each request: its executable path and user, from the event that started it.
  • No content. No prompts, responses, or files are read.
Every search runs through the NG-SIEM search API, in the repository you choose.

​
Prerequisites

  • Shadow AI discovery and the CrowdStrike connector turned on for your deployment.
  • Falcon Next-Gen SIEM, with your Falcon endpoint telemetry searchable in it.
  • A Falcon admin who can create an API client.
  • Someone who can set an environment variable where Openlayer runs. If Openlayer hosts your deployment, that’s us.

​
Set up

1

Create an API client in Falcon

In the Falcon console, open API clients and keys and click Add new API client. Give it the NGSIEM scope with both Read and Write. Openlayer starts searches, which needs Write, so Read alone isn’t enough. The client doesn’t need any other scope.Copy the client ID and secret. Note your Falcon cloud region too. Your console’s address shows it: falcon.us-2.crowdstrike.com is US-2, falcon.eu-1.crowdstrike.com is EU-1, and falcon.crowdstrike.com, with no region, is US-1. Ask your Falcon admin if you’re unsure.
2

Put the secret in an environment variable

Set the client secret in an environment variable where Openlayer runs, such as OLGA_CROWDSTRIKE_CLIENT_SECRET, and restart Openlayer. If Openlayer hosts your deployment, coordinate with us to set it.The admin portal stores only the variable’s name, never the secret.
3

Connect CrowdStrike

In the admin portal, go to Shadow AI → Discovery, click Connect, and choose CrowdStrike Falcon. Fill in:
  • Region: your Falcon cloud: US-1, US-2, US-3, EU-1, US-GOV-1, or US-GOV-2.
  • API client ID: the client ID from the first step.
  • Client secret env var: the variable from the previous step. It defaults to OLGA_CROWDSTRIKE_CLIENT_SECRET.
  • NG-SIEM repository: keep search-all unless we suggest otherwise. investigate_view needs Falcon Insight XDR.
  • Member CID (optional): for MSSPs only, the child tenant to read. Leave it empty to read the API client’s own tenant.
Click Connect. Openlayer exchanges the credentials for a token and runs a one-hour test search. If a scope is missing, the error names it. Zero rows in the test hour means you’re connected and nothing was observed in that hour, not that no one uses AI.The first collection starts right away.

​
How Openlayer collects

  • It searches every hour. Click Sync now on the connector card to start a run immediately. Only one run happens at a time.
  • The first run reads back up to 7 days, or as far as your NG-SIEM retention reaches, if that’s less. Later runs start 3 hours before where the last one stopped, so telemetry that a sensor uploads late is still counted, and read up to the last complete hour.
  • It runs two searches for each hour. The first finds DNS requests to AI services, grouped by process. The second looks up each process’s executable path and user from the event that started it, over the whole lookback, so apps started days earlier still resolve. A process is looked up once and then cached.
  • It maps executable paths to client tools, such as Claude Code, Claude Desktop, Cursor, ChatGPT Desktop, OpenAI Codex CLI, GitHub Copilot CLI, Windsurf, VS Code, and the major browsers. A process it can’t look up keeps its executable name and an unknown user. The connector card shows what share of DNS requests were matched to a process.
  • It skips lookups made on behalf of other apps. VPN clients, the Cloudflare One Client, the Zscaler Client Connector, and system DNS resolvers resolve domains for every app on a device, so their lookups can’t be attributed and are dropped.
  • It never double-counts. Re-reading an hour leaves the same rows, so overlapping runs count nothing twice.
  • It reports incomplete data. A search that hits Falcon’s result limit is split by device and run again. An hour that’s still truncated after splitting is stored and shown as partial on the card. If Openlayer couldn’t collect for longer than the lookback, the missing hours are shown as a coverage gap, never as zero.

​
How findings appear

  • Findings are counted in active hours. An active hour is one user, one client tool, one device, and one AI service seen together in an hour. It isn’t a prompt or a request count.
  • Findings list the devices and client tools that reached each service.
  • A service with 40 or more active hours in the range you’re viewing, seen recently, has its risk raised by one level. See Risk.
  • Falcon telemetry has no blocked attempts.
Openlayer stores the active hours for 30 days, plus a cache of the processes it has looked up. It never stores raw events.

​
The connector card

Open Connect on the Discovery page to see the CrowdStrike card. It shows:
  • The region and repository Openlayer verified, and the rows found in the test hour.
  • When it last synced, and how far its coverage reaches.
  • What the last run did: hours read, rows stored, and the share of DNS requests matched to a process.
  • Warnings for partial hours and coverage gaps.
  • Errors, each with a suggested fix.

​
Disconnecting

Disconnecting CrowdStrike deletes its stored rows and its process cache. So does reconnecting to a different tenant: another client ID, region, or member CID. That tenant’s history is then collected afresh. Reconnecting the same tenant keeps everything.

​
Limitations

  • Only devices that run the Falcon sensor are covered.
  • An hour counts only if the device looked up the service’s domain during it. An app that keeps one connection open for hours may not look the domain up again.
  • On devices where a VPN or secure web gateway client resolves DNS for every app, lookups can’t be attributed to a client tool, and are dropped.
  • No prompt or file content is available.

​
Troubleshooting

In Falcon, open API clients and keys, edit the API client, and grant NGSIEM with both Read and Write. Then click Sync now on the card.
Check the client ID, and that the environment variable where Openlayer runs holds that client’s secret. After you change the variable, restart Openlayer.
investigate_view needs Falcon Insight XDR. Disconnect, and connect again with the search-all repository.
Disconnect, and connect again with your Falcon cloud region. See Create an API client in Falcon for how to tell which region you’re on.
Openlayer looks processes up within the lookback. Processes that started before it, such as long-running apps on devices that rarely restart, keep their executable name and an unknown user.