Integrations CrowdStrike Falcon
Integration · XDR and EDR
Get more from CrowdStrike Falcon without giving up control.
ApexAI connects to CrowdStrike Falcon read-only and treats it as a trusted witness: what the sensor saw, what it blocked and how each host is protected. That evidence joins the rest of your SOC data on one entity, and any response goes back to Falcon only as a proposal a person approves.
Status: Preview The Falcon connector, including MSSP parent and child accounts, runs read-only; its use in triage and response proposals is in preview, and no action is executed in Falcon.
Your EDR as part of every verdict
An EDR knows things a SIEM alert cannot tell you: whether a process was actually stopped, which protection policy a host really has, and whether a sensor is missing or in a reduced mode. ApexAI reads that context from Falcon and puts it next to the alert, so a case says plainly whether an attempt was blocked or got through.
The connector is read-only in code. Only read requests on an allowlist leave ApexAI, and anything else is refused before it reaches the network, even if the API client you create has more rights. Rate limits are respected and data is pulled incrementally.
What Falcon brings into ApexAI
Alerts with context
Falcon alerts with process, command line, file hash and parent, joined to the same host and time window as your SIEM alerts in one case per entity.
Device verdict
Whether Falcon blocked, killed, quarantined or only detected, shown in notices as evidence, not guessed.
Host facts
Operating system, sensor state, groups, tags, containment state and last seen, used to understand each asset’s role and importance.
Protection posture
Prevention, response and firewall policies, device control and exclusions, so hosts in detect-only mode or with over-broad exclusions stand out.
Coverage gaps
Hosts without a working sensor or with reduced functionality are reported as blind spots.
Threat intelligence
Falcon actor and report context feeds threat intelligence and actor mapping in investigations.
Built for MSSPs
Managed security providers often run one Falcon parent console with many customer child accounts. ApexAI supports this directly. A platform operator binds each child account to its own ApexAI tenant, and data from an account that is not bound is not used anywhere. Customers never see each other’s hosts or alerts.
Response through the tool you own
Falcon can contain a host, block an indicator or change a policy. ApexAI prepares these as proposals, not actions.
01
Evidence
Each proposal shows why: the detection, the entity, the host’s protection and what Falcon already did.
02
Exact change
It states what would change, its scope (never global), the expected effect and how to roll it back.
03
Approval
A person decides. Executing any action class requires an explicit decision per integration, with a gradual ramp and a full audit trail.
Questions
Can ApexAI contain hosts in my Falcon console?
Not by itself. It prepares containment and other actions as proposals with evidence and rollback. Nothing is executed in Falcon today, and enabling execution later needs your explicit decision per action class.
Does it support CrowdStrike MSSP setups?
Yes. Parent and child accounts are supported, each child bound to one tenant by a platform operator. Unbound accounts are not used.
What permissions does the API client need?
Read scopes for the data you want ApexAI to use, such as alerts, hosts and policies. ApexAI refuses write calls in its own code regardless of the scopes granted.
See ApexAI on your own alerts.
A walkthrough with your team, in observe mode first: ApexAI scores and proposes, nothing acts on its own.