Deploy Falcon Endpoint Collector

A single Falcon Endpoint collector deployment enables both the

Falcon Browser Extension and Network Inspection integrations. Review the requirements for each integration before you deploy.

Deploy Falcon sensor

Install the Falcon sensor on all endpoints that you want to monitor with the Falcon Endpoint collector.

The sensor version must meet the requirements for your integration.

For more information, see

Sensor Deployment and Maintenance .

After you install the sensor, add the endpoints to a host group. You assign this host group to the AIDR deployment policy in later steps. If you use the Falcon browser extension, you also assign the host group to a browser extension policy.

For more information, see Host and Host Group Management .

Deploy Falcon browser extension

The AIDR deployment policy enables the AIDR module on the Falcon browser extension but doesn't install the extension itself. Deploy the extension separately before enabling AIDR.

Deployment methods differ by platform:

• Windows - Create a browser extension policy and assign host groups. To deploy the extension, enable automatic installation in the policy settings or use MDM tools, such as Intune and Workspace ONE.
• Mac - Deploy the extension through MDM, such as Jamf Pro, or enterprise browser cloud management. Automatic installation through the Falcon console is not available on Mac. A browser extension policy is optional - the default policy covers all hosts.

For deployment options and platform-specific steps, see Falcon Browser Extension .

After you deploy the extension, you can enable AIDR integration with the Falcon browser extension in the Falcon Endpoint policy settings.

note:

Network Inspection is built into the Falcon sensor and requires no separate installation. You can enable AIDR integration with Network Inspection in the Falcon Endpoint policy settings.

Configure policy

Create policy

Create a Falcon Endpoint policy to define the detection rules for this collector.

1. In the Falcon console, go to AIDR detection and response > Policies.
2. Click + Policy.
3. Select Falcon Endpoint as the policy type.
4. Enter a Display Name.
5. Click Save.

AIDR creates the policy and opens its details page where you can configure it. To open the policy details later, select your policy from the list on the Policies page.

Settings

After you create the policy, configure the integration settings on the Settings tab of the policy details page.

1. On the policy details page, click the Settings tab.

2. Enable or disable the following toggles based on the integrations you want to activate:

   • Browser - Enabled by default, this setting activates Falcon browser extension monitoring of AI activity in Chrome and Edge.

   • Network - Enabled by default, this setting activates network-layer monitoring of AI activity from desktop applications, CLIs, and browsers for supported apps. For network events, AIDR operates in report-only mode.

   • User Input and Response - Enabled by default, this setting limits analysis to the user's input and the immediate assistant response within captured events. Other content, such as tool definitions, system messages, and intermediate agentic steps, is excluded. This setting applies to events from both browser and network sources.

     Agentic tools, such as Claude Code, generate significantly more traffic per interaction than browser-based chat. With this setting enabled, AIDR processes only the user-authored input and assistant response, keeping volume and billing predictable. To gain full visibility into agentic traffic, disable this setting.

     note:

     Disabling this setting significantly increases the volume of analyzed and logged data and associated costs. Test appropriately before disabling this setting in production environments.

3. Click Save Changes.

Site Access

The Site Access tab applies only to the Falcon browser extension integration.

For more information, see Site Access .

Inspection Rules

When you create a Falcon Endpoint policy, AIDR creates four default inspection rules with the following event route conditions:

Rule	Condition
Browser Input	app.event_type == input and app.event_source == browser and app.is_agent == false
Browser Output	app.event_type == output and app.event_source == browser and app.is_agent == false
Agent Input	app.event_type == input and app.event_source == network and app.is_agent == true
Network Input	app.event_type == input and app.event_source == network

Falcon Endpoint inspection rules support additional event route condition attributes, including:

Attribute	Type	Description
app.event_source	string	Source of the event: browser or network
app.is_agent	bool	Traffic identified as agentic AI usage
app.domain	string	Target domain of the LLM request
app.agent_id	string	Falcon sensor Agent ID (AID)
app.hostname	string	Endpoint hostname reported by the sensor
app.process_id	number	Target process ID

For more information, see Inspection Rules .

Register and deploy collector

Register collector

1. On the Collectors page, click + Collector.

2. Click Falcon Endpoint, select Falcon Endpoint as the collector type and click Next.

3. On the Add a Collector screen:

   • Collector Name - Enter a descriptive name for the collector. This name appears in dashboards and reports.
   • Logging - Select whether to log prompt data and model responses, or only metadata sent to AIDR. You can also exclude prompt content in access rule action settings .
   • Policy (optional) - Assign a policy to analyze incoming data and model responses.

   The assigned policy determines which detections run on data sent to AIDR. Policies define rules for detecting malicious activity, sensitive data exposure, topic violations, and other risks in AI interactions.

   • Select an existing policy available for this collector type.

     The selected policy name appears under the dropdown. After you save the collector registration, this label becomes a link to the corresponding policy page.

     You can create a new policy on the Policies page.

   • You can select No Policy, Log Only. Without a policy, AIDR records activity for visibility and analysis without applying detection rules.

4. Click Save to complete collector registration.

This opens the collector details page, where you can:

• Update the collector name, logging preference, and policy assignment.
• Click the policy link to view the policy details.
• View installation instructions for the collector type on the Install tab.
• View the collector configuration activity logs.

To open the collector details later, select your collector from the list on the Collectors page.

Deploy collector

After you register the collector, create an AIDR deployment policy to assign the collector to Falcon host groups. This policy enables AIDR capabilities on endpoints in the assigned groups, including the Falcon browser extension and Network Inspection.

Create AIDR deployment policy

1. On the collector details page, click Install.

2. Click Manage AIDR Endpoint Policies.

   You can also open AIDR deployment policies from the main menu: AIDR detection and response > AIDR Deployment Policy.

3. On the AIDR deployment policies page, click Create policy.

4. Enter a policy name and description.

5. Click Create policy.

Assign collector to AIDR deployment policy

1. On the deployment policy details page, under AIDR Collector, select your registered Falcon Endpoint collector from the Collector dropdown.
2. Click Save.

Assign host groups

1. On the deployment policy details page, click Assigned host groups.
2. Click Assign host groups.
3. Select the host groups you want to assign to the policy.
4. Click Assign n groups.

After you assign host groups, click a group name to open the group details:

• To return to the deployment policy page, click the policy name in the list of policies using this host group.

• To view the hosts in the group, click View host group detail page. This opens Host setup and management > Host groups in the Falcon console.

  For more information about managing host groups, see Host and Host Group Management .

Enable the deployment policy

1. To activate the deployment policy, click Enable policy on the deployment policy page.

   If multiple deployment policies apply to a host group, the policy with the highest precedence takes effect.

2. To deactivate the policy later, click Disable policy and follow the confirmation steps.

Verify deployment

Verify integration with Falcon browser extension

After you enable the deployment policy, verify that the collector is active and sending events to AIDR:

1. On an endpoint in the assigned host group, open a supported browser, Chrome or Edge.
2. Browse to a site matched by your Falcon Endpoint policy; for example, a site in your Site Access rules.
3. Submit a prompt to generate activity matched by your Falcon Endpoint policy rules.
4. In the Falcon console, go to AIDR detection and response > Findings.
5. Filter by Collector Type Falcon Endpoint (falcon_endpoint) and Tags containing Browser and confirm that new events appear.

If no events appear after several minutes, check the following:

• Verify that the endpoint's Falcon sensor version meets the requirements for your integration .
• Confirm that the AIDR deployment policy is enabled and assigned to the correct host group.

Verify integration with Network Inspection

After you enable the deployment policy, verify that the collector is active and sending events to AIDR:

1. On an endpoint in the assigned host group, open a supported AI desktop application.
2. Submit a prompt to generate activity matched by your Falcon Endpoint policy rules.
3. In the Falcon console, go to AIDR detection and response > Findings.
4. Filter by Collector Type Falcon Endpoint (falcon_endpoint) and Tags containing Network and confirm that new events appear.

If no events appear after several minutes, check the following:

• Verify that the endpoint's Falcon sensor version meets the requirements for your integration .
• Confirm that the AIDR deployment policy is enabled and assigned to the correct host group.

View collector data

Falcon browser extension data

You can identify Falcon browser extension events by collector type falcon_endpoint, event source browser, and a Browser value present in tags.

The Falcon browser extension populates these fields:

• event_source - Event origin: browser.
• collector_instance_id - Falcon sensor AID. Join this value with agent.id in sensor event repositories for cross-dataset correlation in Next-Gen SIEM.
• user_id - Windows Security Identifier (SID) of the user session.
• extra_info.user_name - User's Windows sign-in name.
• extra_info.hostname - Hostname of the endpoint.
• extra_info.extension_version - Falcon browser extension version.
• extra_info.site_url - URL of the AI application page.

Findings

Example JSON representation of Falcon browser extension event data in Findings

{
  ...
  "collector_type": "falcon_endpoint",
  "collector_name": "My Falcon Endpoint collector",
  "event_source": "browser",
  "collector_instance_id": "92d83ea497e64ca79d630a57ec474d0d",
  "user_id": "S-1-5-21-1729003050-33016928-2308870259-1004",
  "citations": {
    "tags": ["Browser"]
  },
  "extra_info": {
    "hostname": "DESKTOP-W10PC01",
    "user_name": "jgoines",
    "extension_version": "2.0.27",
    "site_url": "https://claude.ai/chat",
    ...
  },
  ...
}

Next-Gen SIEM fields

Falcon Endpoint events include endpoint identification fields that the parser promotes to top-level fields:

• host.hostname - Parsed from Vendor.extra_info.hostname, lowercased.
• ComputerName - Parsed from Vendor.extra_info.hostname, original case.

Example Falcon Endpoint event in Next-Gen SIEM

{
  ...
  "agent.type": "falcon_endpoint",
  "agent.name": "My Falcon Endpoint collector",
  "host.hostname": "desktop-w10pc01",
  "ComputerName": "DESKTOP-W10PC01",
  "Vendor.event_source": "browser",
  "Vendor.collector_instance_id": "92d83ea497e64ca79d630a57ec474d0d",
  "Vendor.extra_info.hostname": "DESKTOP-W10PC01",
  "Vendor.extra_info.user_name": "jgoines",
  "Vendor.extra_info.extension_version": "2.0.27",
  "Vendor.extra_info.site_url": "https://claude.ai/chat",
  "Vendor.collector_type": "falcon_endpoint",
  "Vendor.citations.tags[0]": "Browser",
  ...
}

Correlation example

Find Falcon Endpoint events and enrich with endpoint data from the same sensor:

Next-Gen SIEM query - Correlate AIDR alerts with endpoint data

defineTable(
  name="host_info",
  query={#repo="base_sensor" #event_simpleName="HostInfo"},
  include=[aid, MachineDomain, ComputerName, event_platform, aip]
)
| #repo="aidr"
  event_type="AIDRPromptDataEvent"
  agent.type="falcon_endpoint"
  Vendor.event_source="browser"
| match(
    table="host_info",
    field=Vendor.collector_instance_id,
    column=aid,
    strict=false
  )
| select([Vendor.collector_instance_id, Vendor.application_name, Vendor.summary, ComputerName, MachineDomain, event_platform, aip, @timestamp])
| sort(@timestamp, order=desc, limit=50)

Network Inspection data

You can identify Network Inspection events by collector type falcon_endpoint, event source network, and a Network value present in tags.

AIDR integration with Network Inspection populates these fields:

• event_source - Event origin: network.
• agent_id - Falcon sensor AID. Join this value with agent.id in sensor event repositories for cross-dataset correlation in Next-Gen SIEM.
• user_id - User's Windows sign-in name.
• hostname - Hostname of the endpoint.
• process_id - Process ID of the application that generated the AI traffic.
• domain - Target AI service domain, such as claude.ai.
• extra_info.sensor_aid - Falcon sensor AID.
• extra_info.sensor_hostname - Endpoint hostname (raw field before parser promotion).
• extra_info.target_process_id - Process ID of the application that generated the AI traffic.
• extra_info.cni_event_id - Sensor-assigned sequence number for the network interception event.
• extra_info.user_name - User's Windows sign-in name.

Findings

Example JSON representation of Network Inspection event data in Findings

{
  ...
  "collector_type": "falcon_endpoint",
  "collector_name": "My Falcon Endpoint collector",
  "event_source": "network",
  "agent_id": "92d83ea497e64ca79d630a57ec474d0d",
  "user_id": "jgoines",
  "hostname": "DESKTOP-W10PC01",
  "process_id": "17291234567",
  "domain": "claude.ai",
  "citations": {
    "tags": ["Agentic", "Network"]
  },
  "extra_info": {
    "sensor_aid": "92d83ea497e64ca79d630a57ec474d0d",
    "sensor_hostname": "DESKTOP-W10PC01",
    "target_process_id": 17291234567,
    "cni_event_id": 42,
    "user_name": "jgoines",
    ...
  },
  ...
}

note:

The Agentic tag appears when AIDR classifies the traffic as agentic AI usage.

Next-Gen SIEM fields

Falcon Endpoint events include endpoint identification fields that the parser promotes to top-level fields:

• host.hostname - Parsed from Vendor.extra_info.sensor_hostname, lowercased. Also available as Vendor.hostname.
• ComputerName - Parsed from Vendor.extra_info.sensor_hostname, original case.
• TargetProcessId - Parsed from Vendor.extra_info.target_process_id. Also available as Vendor.process_id.
• agent.id and aid - Parsed from Vendor.extra_info.sensor_aid. Also available as Vendor.agent_id.

Example Network Inspection event in Next-Gen SIEM

{
  ...
  "agent.type": "falcon_endpoint",
  "agent.name": "My Falcon Endpoint collector",
  "agent.id": "92d83ea497e64ca79d630a57ec474d0d",
  "aid": "92d83ea497e64ca79d630a57ec474d0d",
  "host.hostname": "desktop-w10pc01",
  "ComputerName": "DESKTOP-W10PC01",
  "TargetProcessId": "17291234567",
  "Vendor.event_source": "network",
  "Vendor.agent_id": "92d83ea497e64ca79d630a57ec474d0d",
  "Vendor.hostname": "DESKTOP-W10PC01",
  "Vendor.domain": "claude.ai",
  "Vendor.process_id": "17291234567",
  "Vendor.extra_info.sensor_aid": "92d83ea497e64ca79d630a57ec474d0d",
  "Vendor.extra_info.sensor_hostname": "DESKTOP-W10PC01",
  "Vendor.extra_info.user_name": "jgoines",
  "Vendor.extra_info.target_process_id": "17291234567",
  "Vendor.extra_info.cni_event_id": "250",
  "Vendor.collector_type": "falcon_endpoint",
  "Vendor.citations.tags[0]": "Agentic",
  "Vendor.citations.tags[1]": "Network",
  ...
}

Correlation example

Find Network Inspection events and enrich with endpoint data from the same sensor:

Next-Gen SIEM query - Correlate AIDR Network Inspection alerts with endpoint data

defineTable(
  name="host_info",
  query={#repo="base_sensor" #event_simpleName="HostInfo"},
  include=[aid, MachineDomain, ComputerName, event_platform, aip]
)
| #repo="aidr"
  event_type="AIDRPromptDataEvent"
  agent.type="falcon_endpoint"
  Vendor.event_source="network"
| match(
    table="host_info",
    field=agent.id,
    column=aid,
    strict=false
  )
| select([agent.id, Vendor.application_name, Vendor.summary, ComputerName, MachineDomain, event_platform, aip, @timestamp])
| sort(@timestamp, order=desc, limit=50)

View findings

View collector event data in AIDR Findings and Visibility:

• Findings - View individual events, filter by collector type, and inspect detection details.
• Visibility - Explore relationships between logged data attributes and view metrics in AIDR dashboards.

For more information about querying AIDR events in LogScale, see Next-Gen SIEM .

Next steps

• If you're migrating from the standalone AIDR browser extension, remove it after verifying the Falcon browser extension.

  During the transition, the standalone AIDR extension automatically disables itself when the Falcon browser extension with the AIDR module is present. After you confirm the Falcon browser extension works correctly, remove the standalone extension.

  To confirm which version is installed, open the AIDR extension from the browser toolbar.

  • Remove standalone v0.6.x
  • Remove standalone v1.x.x