🦅

Connecting CrowdStrike Falcon to Ayzal AI

Stream CrowdStrike detections to Agentic SOC for centralized monitoring and AI-driven investigation.

📋 Prerequisites

  • An active Ayzal AI Agentic SOC Platform account with API key
  • CrowdStrike Falcon with Event Streams access

⚡ Option 1: Using Fusion SOAR (Recommended)

  1. Log in to Falcon Console → Fusion → Workflows
  2. Click Create Workflow
  3. Add trigger: Detection → New Detection
  4. Add action: Webhook
  5. Configure URL: https://api.ayzalai.com/api/integrations/crowdstrike
  6. Add header: X-API-Key: YOUR_API_KEY
  7. Save and activate the workflow

📡 Option 2: Using Event Streams (Legacy)

  1. Log into Falcon Console
  2. Navigate to Event Streams
  3. Create a new Custom Event Stream
  4. Configure:
    Event Type: DetectionSummaryEvent Webhook URL: https://api.ayzalai.com/api/integrations/crowdstrike Auth Header: x-api-key = YOUR_API_KEY
  5. Enable the stream

🎯 Supported Detection Types

  • Malware detections
  • Suspicious process execution
  • Credential dumping attempts
  • Lateral movement detection
  • All Falcon detection summary events

✅ Result: Check your Agentic SOC dashboard, detections will appear as alerts within seconds.

⚠️ Important: Make sure your API key has active status in Ayzal AI Agentic SOC Platform Settings.