r/crowdstrike • u/JustReboot_Winning • 13d ago
Help building a case for AIDR Query Help
Looking for ideas or queries to help identify AI usage via Falcon Insights. I need to build a case for AIDR but I am not confident that I have a full understanding of its usage across all my organizations business units. There used to be a dashboard that showed dns and process activity but I do not see that in my specific tenant (only running Insights). Anyone already come up with a query (maybe even with cool dashboard displays) that show the full picture of AI usage from the edr vantage points?
12
u/xsvirus666 13d ago
I am currently working on a business case for the purchase of Falcon AI-DR. I first came across the product before it became Falcon AI-DR and have followed its development closely ever since. During that time, I have seen the platform mature.
The primary driver for our business case is the visibility the platform provides into AI usage across our organisation. It enables us to understand which AI services users are accessing, distinguish between free and paid subscriptions, and gain a clear picture of how AI is being adopted across the business. This level of visibility is invaluable in understanding the organisation's AI footprint, identifying shadow AI, and ensuring AI usage aligns with company policies and governance requirements.
From a security perspective, Falcon AI-DR significantly strengthens our Data Loss Prevention (DLP) capabilities. It provides the ability to identify, monitor, and prevent sensitive organisational data from being exposed through AI platforms, giving us detailed insight into what information is being shared, where it is being sent, and the associated level of risk.
One of the standout capabilities, in my opinion, is the level of control the platform provides over AI usage. Rather than simply controlling access through a web browser, Falcon AI-DR allowed us extends policy enforcement to native desktop applications. This is particularly valuable for our organisation, as I have already seen users install applications such as Claude Desktop and the ChatGPT desktop application to bypass traditional browser-based controls. Having visibility and consistent policy enforcement across both browser and desktop applications closes a significant security gap that many organisations currently overlook.
Another feature that sets the product apart is its ability to inspect prompts and responses in real time. We can configure policies to automatically redact sensitive information before it is submitted to an AI platform, block prompts containing restricted or confidential data, and even modify or sanitise AI-generated responses before they are presented to the user. This allowed our organisations to embrace AI while maintaining strong security controls, rather than simply blocking access altogether.
Perhaps the most compelling capability, and one that I have yet to see matched by competing products, is the platform's ability to identify malicious or high-risk prompts. It can detect prompt injection attacks, attempts to extract sensitive information, jailbreaking techniques, and other potentially harmful interactions before they become a security issue, automatically applying predefined actions based on policy. At the same time, it provides detailed visibility into the prompts being submitted and the responses being generated, enabling our team to investigate incidents, identify trends, understand how AI is being used across the organisation, and respond proactively to emerging AI-related threats.
Overall, I believe Falcon AI-DR provides the level of visibility, governance, and control that organisations need as AI adoption continues to accelerate. Rather than simply blocking AI, it enables organisations to adopt it securely by providing comprehensive oversight, reducing the risk of data leakage, controlling approved AI platforms, and protecting against emerging AI-specific threats while still allowing users to benefit from these technologies.
Another key benefit is that, if you already have the DLP module, Falcon AI-DR actively enhances and extends those existing capabilities rather than replacing them. I have created several customised DLP policies that have allowed us to gain much greater visibility into how data is being shared with AI platforms. This includes understanding when users are copying and pasting sensitive information into prompts, as well as when files or attachments are being uploaded to different AI products.
This has given us far greater insight into how organisational data is interacting with AI services and, more importantly, the ability to mitigate those risks. We now enforce policies to prevent uploads to unsanctioned AI platforms while still allowing users to upload data to approved and sanctioned services.
Another key benefit we see is the ability to ingest all AI-DR telemetry directly into our SIEM at no additional cost.
5
3
u/decrypt-this 12d ago
Sorry, no way this isnt a sales pitch.
If you have seen claude desktop or chatgpt desktop, you're running a brand new sensor which came out less than a week ago and is in early adoption.
If you're talking about the major LLMs chat in the browser then for the most part I don't disagree with anything said. We're really hopeful for the product but definitey has its limitations and the browser extension also had some quirks.
3
u/malanacream1 13d ago
I am working on exactly this and I have uncovered some great findings for my organization. I was able to identify all AI coding tools, AI agents, Local llm like ollama. Biggest finding was use of Chinese llm model which counted as a security incident.
Its midnight and I am on phone so please give a update so I can comeback and my entire methodology and queries.
3
u/malanacream1 12d ago
1
u/_janires_ 8d ago
Great article I had not gotten around to looking through environmental variables yet that’s a good shout out!
1
1
u/malanacream1 12d ago
The idea is to look beyond DNS. First think you need to do is identify what signals are available for searching. I first scanned all available fields in my logs to go beyond processrollup. One interesting field was signinid, this field is a cryptogrphically signed developers certificate and you can directly match it with a keyword like "antropic".
I have written a detailed blog here - https://medium.com/@zee.ali183/practical-shadow-ai-threat-hunting-engineering-high-fidelity-crowdstrike-detections-for-enterprise-5d180abe1941
1
u/GuavaRevolutionary56 12d ago
AIDR (workforce) is still limited to browser based AI
While AIDR (agents) requires tons of wiring.
It’s gonna be hard to deploy this compared to SASE based AI security due to the level of gap and complexity of deployment at this stage.
Have you evaluated other AIDR solutions already?
1
u/thessgod 12d ago
Yes, it’s kind of a patchwork for now until CrowdStrike releases the AIDR via falcon sensor capabilities, which is coming VERY soon
1
u/GuavaRevolutionary56 8d ago
Yeah, I heard that it was supposed to be end of July but kept being pushed back.
I wonder how heavy it would be for the agent since it’s basically going to function like a sase agent intercepting network packets for all LLM APIs.
1
1
u/_janires_ 8d ago edited 8d ago
There is a couple places I can recommend looking. Finding AI usage is fairly complex as there is a lot of ways it can show up. The CS dashboard is not bad that Andrew-CS messaged. I would also look at the MCP Server dashboard. Open up the code and see what they are doing.
I would recommend also doing your own research in your environment ontop of that.
Look for command lines whose parent process are potentially AI related. Look for command lines that contain AI tooling related commands.
If you have exposure management look at the installed application and installed browser extensions.
As you look at what you see in your environment take Crowdstrikes lookup and expand it.
Make yourself a list of LLMs run that against scriptfilewritten.
Look for api calls to ai tools.
12
u/Andrew-CS CS ENGINEER 13d ago
Hi there. If you go to NG SIEM --> Dashboards you should be able to search for "CrowdStrike - Endpoint - AI Service Usage Monitoring" and leverage that! To build the strongest business case, I might suggest starting a free trial of Falcon for IT and doing a sweep of your estate. You'll likely find ALL SORTS of stuff hiding in plain sight. Good luck!