> ## Documentation Index > Fetch the complete documentation index at: https://docs.openlayer.com/llms.txt > Use this file to discover all available pages before exploring further. # CrowdStrike Falcon Guardian > Import AI coding agent prompts, tool calls, and model usage from CrowdStrike Falcon Guardian into Openlayer, with one project per agent product ![The CrowdStrike Falcon logo on a purple gradient](https://mintcdn.com/openlayer-44/maqMqCY0nMVuoosi/images/integrations/crowdstrike_falcon_aidr_hero.png?fit=max\&auto=format\&n=maqMqCY0nMVuoosi\&q=85\&s=3c22fd1afa779efb5a84958af981c00a) [CrowdStrike Falcon Guardian](https://www.crowdstrike.com/en-us/platform/falcon-guardian-aidr/), formerly Falcon AI Detection and Response (AIDR), records activity from AI coding agents running on machines with the Falcon sensor. Openlayer pulls their prompts, tool calls, and model usage into a separate project for each agent product, where you can run tests and review real usage. Nothing is installed on developer machines beyond the Falcon sensor you already run. This is the right integration when you govern AI coding agents across your endpoints and already use Falcon Guardian. It covers every agent product Falcon reports, whatever vendor plan each developer is on. Other integrations capture some of the same activity from a different angle: * [Claude Code](/integrations/claude-code) exports OpenTelemetry traces from Claude Code itself, configured through Claude managed settings. Use it when you need Claude Code's model requests and tool runs step by step, not only prompts. * [Claude Compliance](/integrations/claude-compliance) and [OpenAI Compliance](/integrations/openai-compliance) read transcripts, including assistant replies, from the vendor's compliance API. They require that vendor's enterprise plan. > [!NOTE] > > All access is **read-only**. The Falcon API client needs only the **Aidr > Events: Read** scope, and Openlayer never changes anything in your Falcon > tenant. ## How it works Once connected, Openlayer reads Falcon Guardian activity from the Falcon API and turns it into inference data. 1. **Discovers agent products.** Falcon tags every prompt and agent session with the product that produced it, such as Claude Code or Codex. Each product Falcon reports appears under **Products**. 2. **Gives each product its own project.** By default, a newly discovered product is enabled into a new `CrowdStrike · ` project, so each agent can be governed separately. Products that are not enabled do not sync. 3. **Pulls on a schedule.** Openlayer syncs every 10 minutes by default. 4. **Writes prompts first, activity later.** Each prompt becomes a row as soon as Openlayer sees it. Tool calls and model usage follow in an **Agent activity** row once the session goes idle. *** ## Prerequisites * A CrowdStrike Falcon tenant with **Falcon Guardian** (formerly the Falcon AIDR module), and the Falcon sensor on the machines where developers run AI agents. * **AIDR API access** turned on for the tenant. When it is off, Falcon rejects every AIDR request with **403**, even for an API client with the right scope. * A Falcon API client with the **Aidr Events: Read** scope, created below. * An Openlayer workspace where you are an **admin**. Connecting, changing settings, enabling, disabling, or moving products, and disconnecting are admin-only. Members can view products and their projects. ### Create the Falcon API client In the Falcon console, go to **Support and resources → API clients and keys** and create an API client with only the **Aidr Events: Read** scope. Copy the client ID and the secret. Falcon shows the secret only once. Also note your tenant's **region**: the Falcon cloud your console runs on. For example, `falcon.crowdstrike.com` is **US-1** and `falcon.eu-1.crowdstrike.com` is **EU-1**. Openlayer supports US-1, US-2, US-3, EU-1, US-GOV-1, and US-GOV-2. The [CrowdStrike Developer Center](https://developer.crowdstrike.com/) covers API clients in general, and [FalconPy](https://github.com/CrowdStrike/falconpy) is a quick way to check a client's credentials and region outside Openlayer. *** ## Setup guide ### Step 1: Connect In Openlayer, go to **Settings → Integrations** and open **CrowdStrike Falcon Guardian** in the **AI Usage & Security** section. Enter the **Client ID**, **Client secret**, and **Region** (US-1 by default). Click **Test connection** to check the credentials without saving them, then click **Connect**. ![The integration connection form in Openlayer, with a client ID, a masked client secret, Region set to US-1, and the Connect and Test connection buttons](https://mintcdn.com/openlayer-44/maqMqCY0nMVuoosi/images/integrations/crowdstrike_falcon_aidr_connect.png?fit=max\&auto=format\&n=maqMqCY0nMVuoosi\&q=85\&s=29dcb943fa38a63133f8f57efca3a755) Openlayer checks the credentials against Falcon before storing them, and encrypts the secret at rest. The stored secret is never returned by later requests. If Falcon rejects the credentials, the form shows Falcon's reason and nothing is saved. On success, the first sync starts and products appear shortly. ### Step 2: Review the sync settings Open the **General** tab. Under **Settings**: * **Periodic sync** pulls new prompts and agent activity from Falcon Guardian. Turn it off to pause syncing without disconnecting, or click **Sync now** to queue a sync immediately. * **Sync frequency** is **Every 10 minutes**, **Every 30 minutes**, or **Every hour**. * **Create a project for new products** is on by default. See [Products and projects](#products-and-projects). The **Overview** on the same tab reports the connection's status, how many products are enabled, prompts synced, last sync, and the last error. A status of **no products enabled** means nothing syncs: no product is enabled and new products are not enabled automatically. ![The integration General tab, with the connection overview and settings for periodic sync, sync frequency, and creating projects for new products](https://mintcdn.com/openlayer-44/maqMqCY0nMVuoosi/images/integrations/crowdstrike_falcon_aidr_connected.png?fit=max\&auto=format\&n=maqMqCY0nMVuoosi\&q=85\&s=e3909819c5cfb16aace424b1ce596178) *** ## Products and projects The **Products** tab lists every AI agent product Falcon Guardian has reported, with its name and Falcon's numeric product tag (for example, Claude Code and `213584428666146`), status, project, sessions seen, and imported prompts. A product appears after a sync once Falcon reports activity for it. ![The Products tab, listing Claude Code, Codex, and Cursor, each idle and syncing into its own CrowdStrike · product project, with sessions seen, imported prompts, and the enable switch](https://mintcdn.com/openlayer-44/maqMqCY0nMVuoosi/images/integrations/crowdstrike_falcon_aidr_products.png?fit=max\&auto=format\&n=maqMqCY0nMVuoosi\&q=85\&s=3df4565fc2e95e0d708fb94a8e02489e) **Create a project for new products** decides what happens to a product the first time Openlayer sees it: * **On** (the default) — Openlayer enables the product into a new `CrowdStrike · ` project and pipeline. If a plan limit or a missing permission blocks the project, the product stays disabled and shows the reason. * **Off** — the product stays **disabled** until an admin enables it. To enable a product by hand, turn on its switch and choose **Create new project** or **Map to existing project**. An existing pipeline must use Openlayer's default storage. Pipelines on a BigQuery or Snowflake backend cannot receive these rows. An enabled product's menu has **View project**, **Change project**, and **Disable**: * **Change project** sends the product's new rows to another project and pipeline. Rows already written stay in the previous project; they are not moved or copied. * **Disable** stops syncing the product. Its project, pipeline, and existing data are kept. * **Re-enabling** a disabled product opens on the project it already had, so it does not create a second project. It restarts the product's 7-day backfill to fill in its disabled period while regular syncs continue to pick up new prompts and sessions. A product shows **backfilling** while Openlayer reads its sessions from the last 7 days, then returns to **idle**. Smaller products usually clear within a few syncs; products with many sessions can take hours. > [!WARNING] > > Falcon Guardian keeps 7 days of activity, so that is as far back as any > backfill reaches. Activity from a product's disabled period that is older than > 7 days when you re-enable it is never imported. *** ## What lands in Openlayer Falcon Guardian records what users ask AI agents and what the agents do, not what they answer. It returns prompts, tool-call inputs, models, and token counts. It does not return assistant responses or tool output, so every row's output is empty. Openlayer writes two kinds of rows into the product's pipeline: | Row | When it is written | Input | Trace | | - | - | - | - | | Prompt | As soon as Openlayer sees the prompt | The prompt text | None | | Agent activity | Once the session has been idle for 30 minutes and its tool calls stop changing | `Agent activity: N tool calls, M agent runs` | One model-usage step per agent run, with the model and prompt and completion tokens, and one tool step per tool call, with its inputs (command, path, URL, query) | ![A Claude Code Agent activity row in Openlayer: a Model usage step for claude-sonnet-4-6 and one step per tool call (Grep, Read, Edit, Write, Bash), with total tokens and an estimated cost](https://mintcdn.com/openlayer-44/maqMqCY0nMVuoosi/images/integrations/crowdstrike_falcon_aidr_trace.png?fit=max\&auto=format\&n=maqMqCY0nMVuoosi\&q=85\&s=5def018e84b66a925dad3def1ec7c837) Selecting a tool step shows the inputs Falcon captured. Here, the Bash command and the agent's stated purpose: ![A Bash tool step in an Agent activity trace, with the captured command (npm test -- src/auth) and description arguments](https://mintcdn.com/openlayer-44/maqMqCY0nMVuoosi/images/integrations/crowdstrike_falcon_aidr_trace_tool.png?fit=max\&auto=format\&n=maqMqCY0nMVuoosi\&q=85\&s=4d024b968568fe771f3f43004514e8de) A few behaviors are not obvious from the trace: * **Tool calls are not attached to prompts.** Falcon gives tool calls no timestamp, so Openlayer cannot tell which prompt caused them. They are grouped into the session's activity row instead. * **Resumed sessions get a follow-up row.** If a session picks up again after its activity row is written, the new calls land in another **Agent activity** row. Rows are never rewritten. * **Sessions are preserved.** Each Falcon Guardian agent session becomes one Openlayer session. * **Users are attributed only when unambiguous.** The user ID is the OS user who ran the agent, and only when exactly one OS user ran agents on that host. Otherwise the user is **anonymous**. * **Cost is estimated.** Openlayer estimates cost on the model-usage step from the model and token counts. * **Long values are cut.** A prompt or tool input longer than 50,000 characters ends with `… [truncated]`. Each row also carries these columns: | Column | Value | | - | - | | `aidr_product` | Falcon's product name, such as `CLAUDE_CODE` | | `aidr_host_id` | The Falcon host the agent ran on | | `aidr_record_type` | `prompt` or `activity` | | `aidr_content` | What the row holds: `prompt_only`, or `tool_inputs_and_usage` for activity rows | *** ## Evaluating the ingested data Once rows are flowing, evaluate AI agent usage the same way you evaluate application traffic: * [Create tests](/tests/overview) on prompts and token usage. Tests that score a response have nothing to score, because outputs are empty. * Detect [PII](/tests/catalog/contains-p-i-i) in the prompts people send to coding agents * Use [governance frameworks](/governance/overview) to evidence AI-usage controls with real traffic *** ## Disconnecting On the **General** tab, click **Disconnect Falcon Guardian** and confirm **Remove Falcon Guardian**. Disconnecting stops syncing and deletes the stored API client. Projects, pipelines, and data already ingested are kept. Delete the API client in the Falcon console afterwards if nothing else uses it. *** ## Troubleshooting | Symptom | Likely cause | Fix | | - | - | - | | **Test connection** or **Connect** fails with **401** | The client ID or secret is wrong, or the API client was deleted | Re-enter both values, or create an API client and use its credentials. A failed test saves nothing | | **Test connection** or **Connect** fails with **403** | The API client lacks **Aidr Events: Read**, or AIDR API access is off for the tenant | Add the scope to the API client, and make sure AIDR API access is turned on for the tenant | | Connect fails although the credentials are right | The region does not match your tenant | Choose the region your Falcon console runs on | | Every row's output is empty | Falcon Guardian does not return assistant responses or tool output | Expected. Prompts, tool inputs, models, and tokens are what Falcon Guardian provides | | The user is **anonymous** | More than one OS user ran agents on that host, or Falcon did not report one | Expected. Openlayer attributes a user only when exactly one OS user ran agents on the host | | A prompt appears but its tool calls and tokens do not | The session has not been idle for 30 minutes yet | Expected. The **Agent activity** row follows once the session settles | | A product does not sync | The product is disabled, or **Periodic sync** is off | Turn on the product's switch, or turn periodic sync back on. Disabled products are skipped | | A new product stays disabled | **Create a project for new products** is off, or a plan limit or permission blocked the project | Enable the product by hand into a new or existing project | | A product stays **backfilling** for hours | The product has many sessions to read | Leave the product enabled. Regular sync continues during the backfill, and busy products can take hours | | The last error says **Partial sync: Falcon Guardian returns a limited number of sessions per query and more were active in this window, so some sessions were not read.** | More sessions were active than Falcon Guardian returned | Leave the product enabled. Regular sync keeps running, and the warning clears after backfills finish | | The last error says **Partial sync: session \ has more prompts than Falcon Guardian returns in one query; older ones were skipped.** | The session has more prompts than Falcon Guardian returned | Leave the product enabled. Regular sync keeps running, and the warning clears after backfills finish | | A re-enabled product is missing older activity | That activity is older than Falcon Guardian's 7-day window | Expected. Backfill reaches back 7 days at most | | A member cannot enable, disable, or move a product, or sync now | These actions are admin-only | Ask a workspace admin | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.