> ## Documentation Index > Fetch the complete documentation index at: https://docs.openlayer.com/llms.txt > Use this file to discover all available pages before exploring further. # CrowdStrike Falcon discovery > Discover which AI services your endpoints reach, and from which client tools, using Falcon sensor telemetry in Next-Gen SIEM The CrowdStrike Falcon connector searches the endpoint telemetry your Falcon sensors already send to **Falcon Next-Gen SIEM** (NG-SIEM). Falcon knows which **process** on which **device** looked up an AI service's domain, so findings show the **client tool**, such as Claude Code, Cursor, or a browser, as well as the user and the device. Each AI service then appears in your [Shadow AI discovery](https://docs.openlayer.com/integrations/shadow-ai-discovery.md) findings, counted in active hours. Openlayer reaches the Falcon API over outbound HTTPS. Nothing needs to reach Openlayer. > [!NOTE] > > This page covers Shadow AI discovery. To import prompts and tool calls from AI > coding agents with Falcon Guardian, see [CrowdStrike Falcon > Guardian](https://docs.openlayer.com/integrations/crowdstrike-falcon-guardian.md). The two connect > separately. > [!NOTE] > > The CrowdStrike connector is turned on separately from Shadow AI discovery. If > it isn't in the **Connectors** dialog, [reach out to > us](mailto:support@openlayer.com) to turn it on. ## What Openlayer reads * **DNS requests** your Falcon sensors recorded for the domains of AI services in the catalog, grouped by device, process, and hour. * **The process behind each request**: its executable path and user, from the event that started it. * **No content.** No prompts, responses, or files are read. Every search runs through the NG-SIEM search API, in the repository you choose. ## Prerequisites * Shadow AI discovery and the CrowdStrike connector turned on for your deployment. * Falcon Next-Gen SIEM, with your Falcon endpoint telemetry searchable in it. * A Falcon admin who can create an API client. * Someone who can set an environment variable where Openlayer runs. If Openlayer hosts your deployment, that's us. ## Set up **1. Create an API client in Falcon** In the Falcon console, open **API clients and keys** and click **Add new API client**. Give it the **NGSIEM** scope with both **Read** and **Write**. Openlayer starts searches, which needs Write, so Read alone isn't enough. The client doesn't need any other scope. Copy the client ID and secret. Note your Falcon cloud region too. Your console's address shows it: `falcon.us-2.crowdstrike.com` is US-2, `falcon.eu-1.crowdstrike.com` is EU-1, and `falcon.crowdstrike.com`, with no region, is US-1. Ask your Falcon admin if you're unsure. **2. Put the secret in an environment variable** Set the client secret in an environment variable where Openlayer runs, such as `OLGA_CROWDSTRIKE_CLIENT_SECRET`, and restart Openlayer. If Openlayer hosts your deployment, coordinate with us to set it. The admin portal stores only the variable's name, never the secret. **3. Connect CrowdStrike** In the admin portal, go to **Shadow AI → Discovery**, click **Connect**, and choose **CrowdStrike Falcon**. Fill in: * **Region**: your Falcon cloud: US-1, US-2, US-3, EU-1, US-GOV-1, or US-GOV-2. * **API client ID**: the client ID from the first step. * **Client secret env var**: the variable from the previous step. It defaults to `OLGA_CROWDSTRIKE_CLIENT_SECRET`. * **NG-SIEM repository**: keep `search-all` unless we suggest otherwise. `investigate_view` needs Falcon Insight XDR. * **Member CID** (optional): for MSSPs only, the child tenant to read. Leave it empty to read the API client's own tenant. Click **Connect**. Openlayer exchanges the credentials for a token and runs a one-hour test search. If a scope is missing, the error names it. Zero rows in the test hour means you're connected and nothing was observed in that hour, not that no one uses AI. The first collection starts right away. ## How Openlayer collects * **It searches every hour.** Click **Sync now** on the connector card to start a run immediately. Only one run happens at a time. * **The first run reads back up to 7 days**, or as far as your NG-SIEM retention reaches, if that's less. Later runs start 3 hours before where the last one stopped, so telemetry that a sensor uploads late is still counted, and read up to the last complete hour. * **It runs two searches for each hour.** The first finds DNS requests to AI services, grouped by process. The second looks up each process's executable path and user from the event that started it, over the whole lookback, so apps started days earlier still resolve. A process is looked up once and then cached. * **It maps executable paths to client tools**, such as Claude Code, Claude Desktop, Cursor, ChatGPT Desktop, OpenAI Codex CLI, GitHub Copilot CLI, Windsurf, VS Code, and the major browsers. A process it can't look up keeps its executable name and an unknown user. The connector card shows what share of DNS requests were matched to a process. * **It skips lookups made on behalf of other apps.** VPN clients, the Cloudflare One Client, the Zscaler Client Connector, and system DNS resolvers resolve domains for every app on a device, so their lookups can't be attributed and are dropped. * **It never double-counts.** Re-reading an hour leaves the same rows, so overlapping runs count nothing twice. * **It reports incomplete data.** A search that hits Falcon's result limit is split by device and run again. An hour that's still truncated after splitting is stored and shown as **partial** on the card. If Openlayer couldn't collect for longer than the lookback, the missing hours are shown as a **coverage gap**, never as zero. ## How findings appear * Findings are counted in **active hours**. An active hour is one user, one client tool, one device, and one AI service seen together in an hour. It isn't a prompt or a request count. * Findings list the devices and client tools that reached each service. * A service with 40 or more active hours in the range you're viewing, seen recently, has its risk raised by one level. See [Risk](https://docs.openlayer.com/integrations/shadow-ai-discovery.md#risk). * Falcon telemetry has no blocked attempts. Openlayer stores the active hours for 30 days, plus a cache of the processes it has looked up. It never stores raw events. ## The connector card Open **Connect** on the Discovery page to see the CrowdStrike card. It shows: * The region and repository Openlayer verified, and the rows found in the test hour. * When it last synced, and how far its coverage reaches. * What the last run did: hours read, rows stored, and the share of DNS requests matched to a process. * Warnings for partial hours and coverage gaps. * Errors, each with a suggested fix. ## Disconnecting Disconnecting CrowdStrike deletes its stored rows and its process cache. So does reconnecting to a different tenant: another client ID, region, or member CID. That tenant's history is then collected afresh. Reconnecting the same tenant keeps everything. ## Limitations * Only devices that run the Falcon sensor are covered. * An hour counts only if the device looked up the service's domain during it. An app that keeps one connection open for hours may not look the domain up again. * On devices where a VPN or secure web gateway client resolves DNS for every app, lookups can't be attributed to a client tool, and are dropped. * No prompt or file content is available. ## Troubleshooting > **The error names a missing scope** > > In Falcon, open **API clients and keys**, edit the API client, and grant > **NGSIEM** with both **Read** and **Write**. Then click **Sync now** on the > card. > **The credentials are rejected** > > Check the client ID, and that the environment variable where Openlayer runs > holds that client's secret. After you change the variable, restart > Openlayer. > **The error mentions investigate\_view** > > `investigate_view` needs Falcon Insight XDR. Disconnect, and connect again > with the `search-all` repository. > **The error mentions the region** > > Disconnect, and connect again with your Falcon cloud region. See [Create an > API client in Falcon](#set-up) for how to tell which region you're on. > **Few DNS requests are matched to a process** > > Openlayer looks processes up within the lookback. Processes that started > before it, such as long-running apps on devices that rarely restart, keep > their executable name and an unknown user. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.