Apigee Collector

Google Cloud Apigee is a fully managed API management platform that enables organizations to design, secure, analyze, and scale APIs.

You can integrate AIDR with Apigee through the open-source CrowdStrike AIDR shared flow bundle . The shared flow inspects both user prompts and LLM responses using the

AIDR APIs , enforcing security controls such as threat detection, PII redaction, and policy-based blocking, without changes to your application code.

You can deploy the shared flow to an Apigee environment and invoke it from your API proxy using FlowCallout policies .

Requirements

• Subscription: AIDR for Agents

• Default roles: AIDR Admin role explicitly assigned to your Falcon user for the current customer account

• Permissions required for custom roles:

  • Manage AIDR findings and agent collectors
  • Read AIDR data from LogScale
  • Read AIDR findings and agent collectors

• CrowdStrike clouds: Available in US-1, US-2, and EU-1

• Network: HTTP access to AIDR origins

• Google Cloud:
  • Project with Apigee provisioned
  • Apigee API proxy that serves LLM traffic in the Vertex AI generateContent format

Register Apigee collector

1. On the Collectors page, click + Collector.

2. Choose Gateway as the collector type, then select Apigee and click Next.

3. On the Add a Collector screen:

   • Collector Name - Enter a descriptive name for the collector. This name appears in dashboards and reports.
   • Logging - Select whether to log prompt data and model responses, or only metadata sent to AIDR. You can also exclude prompt content in access rule action settings .
   • Policy (optional) - Assign a policy to analyze incoming data and model responses.

   The assigned policy determines which detections run on data sent to AIDR. Policies define rules for detecting malicious activity, sensitive data exposure, topic violations, and other risks in AI interactions.

   • You can select an existing policy available for this collector type or create a policy on the Policies page.

     The selected policy name appears under the dropdown. After you save the collector registration, this label becomes a link to the corresponding policy page.

   • You can also select No Policy, Log Only. Without a policy, AIDR records activity for visibility and analysis without applying detection rules.

4. Click Save to complete collector registration.

This opens the collector details page, where you can:

• Update the collector name, logging preference, and policy assignment.
• Click the policy link to view the policy details.
• Copy credentials and AIDR base URL from the Config tab to call AIDR APIs.
• View installation instructions for the collector type on the Install tab.
• View the collector configuration activity logs.

To open the collector details page later, select your collector from the list on the Collectors page.

Deploy collector

Download and import shared flow

1. Download the latest release of the CrowdStrike AIDR shared flow from the GitHub releases page .
2. In the Google Cloud console, go to Apigee Shared flows .
3. Click Upload bundle and upload the downloaded shared flow archive.
4. Name the shared flow cs-aidr-guard.
5. Deploy the shared flow to the same Apigee environment as the API proxy you want to protect.

Create policies in your API proxy

In your API proxy, create the following three policies.

1. AssignMessage - Set AIDR configuration

The AM-SetAIDRConfig policy sets the AIDR API token and base URL as flow variables that the shared flow uses to call AIDR APIs.

You can copy both values from the collector's Config tab in the AIDR console.

Example AM-SetAIDRConfig.xml

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AssignMessage async="false" continueOnError="false" enabled="true" name="AM-SetAIDRConfig">
  <DisplayName>AM-SetAIDRConfig</DisplayName>
  <Properties/>
  <AssignVariable>
    <Name>cs_aidr_token</Name>
    <Value>pts_lj3nqp...6ssc3k</Value>
  </AssignVariable>
  <AssignVariable>
    <Name>aiguard_base_url</Name>
    <Value>api.crowdstrike.com/aidr/aiguard</Value>
  </AssignVariable>
  <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
</AssignMessage>

• cs_aidr_token - Your AIDR API token
• aiguard_base_url - AIDR API endpoint for your region (without the https:// protocol prefix)

2. FlowCallout - Guard LLM input

The FC-LLMGuardInput policy invokes the shared flow to inspect the request before it reaches the LLM provider.

FC-LLMGuardInput.xml

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<FlowCallout async="false" continueOnError="false" enabled="true" name="FC-LLMGuardInput">
  <DisplayName>FC-LLMGuardInput</DisplayName>
  <Properties/>
  <SharedFlowBundle>cs-aidr-guard</SharedFlowBundle>
</FlowCallout>

3. FlowCallout - Guard LLM output

The FC-LLMGuardOutput policy invokes the shared flow to inspect the response from the LLM provider before it is returned to the client.

FC-LLMGuardOutput.xml

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<FlowCallout async="false" continueOnError="false" enabled="true" name="FC-LLMGuardOutput">
  <DisplayName>FC-LLMGuardOutput</DisplayName>
  <Properties/>
  <SharedFlowBundle>cs-aidr-guard</SharedFlowBundle>
</FlowCallout>

Attach policies to proxy flow

After creating the policies, attach them to your API proxy's flow:

1. Add AM-SetAIDRConfig and FC-LLMGuardInput to the request PreFlow - this runs AIDR input checks before forwarding the request to the LLM provider.
2. Add FC-LLMGuardOutput to the response PostFlow - this runs AIDR output checks on the LLM response before returning it to the client.

You can also use flow hooks to attach the shared flow at the environment level, applying it to all API proxies in that environment without modifying individual proxy configurations.

note:

Policies are automatically associated with the collector's policy rules:

• Request PreFlow policies - Input Rules
• Response PostFlow policies - Output Rules

Request schema

The shared flow expects API proxy requests and responses to follow the Vertex AI generateContent schema .

Make sure your API proxy handles requests in this format so the shared flow can correctly parse and inspect the content.

Next steps

• View collected data on Visibility and Findings pages. Analyze it in Next-Gen SIEM to decide on further implementation steps.

• Determine which policy to apply:

  • Start with monitoring policies and report actions.
  • Apply protection to identified risks by enforcing blocking and data transformation actions based on your organization’s AI usage guidelines.

• For more information, see Collector Categories.