JetStream AI Hub Collector

JetStream is a platform for deploying, managing, and scaling AI applications and LLM workloads.

The JetStream AI Hub routes and governs API traffic to LLM providers. You can monitor and protect AI traffic flowing through the JetStream AI Hubs by deploying the AIDR collector as a JetStream guardrail.

After you configure the collector, the gateway forwards API request and response data to AIDR for analysis. You can define policy rules to evaluate content, report in AIDR logs, and enforce an action - allow, block, or redact. The gateway applies the action before forwarding requests to the AI provider or returning responses to users.

Considerations:

• JetStream does not include tool definitions or tool interaction messages in requests to AIDR. Detectors that analyze tool content, such as MCP Validation, do not apply to JetStream traffic.
• JetStream does not send request metadata, such as app_id, user_id, or model, to AIDR. These fields appear as unknown in AIDR logs and cannot be used in access rules.
• JetStream does not support decrypting redacted content with Format Preserving Encryption (FPE).

Requirements

• Subscription: AIDR for Agents

• Default roles: AIDR Admin role explicitly assigned to your Falcon user for the current customer account

• Permissions required for custom roles:

  • Manage AIDR findings and agent collectors
  • Read AIDR data from LogScale
  • Read AIDR findings and agent collectors

• CrowdStrike clouds: Available in US-1, US-2, and EU-1

• Network: HTTP access to

  AIDR origins

• JetStream: JetStream account with an AI Hub configured

Register JetStream collector

1. On the Collectors page, click + Collector.

2. Choose Gateway as the collector type, then select JetStream and click Next.

3. On the Add a Collector screen:

   • Collector Name - Enter a descriptive name for the collector. This name appears in dashboards and reports.
   • Logging - Select whether to log prompt data and model responses, or only metadata sent to AIDR. You can also exclude prompt content in access rule action settings .
   • Policy (optional) - Assign a policy to analyze incoming data and model responses.

   The assigned policy determines which detections run on data sent to AIDR. Policies define rules for detecting malicious activity, sensitive data exposure, topic violations, and other risks in AI interactions.

   • Select an existing policy available for this collector type.

     The selected policy name appears under the dropdown. After you save the collector registration, this label becomes a link to the corresponding policy page.

     You can create a new policy on the Policies page.

   • You can select No Policy, Log Only. Without a policy, AIDR records activity for visibility and analysis without applying detection rules.

4. Click Save to complete collector registration.

This opens the collector details page, where you can:

• Update the collector name, logging preference, and policy assignment.
• Click the policy link to view the policy details.
• Copy credentials and AIDR base URL from the Config tab to call AIDR APIs.
• View installation instructions for the collector type on the Install tab.
• View the collector configuration activity logs.

To open the collector details later, select your collector from the list on the Collectors page.

Deploy collector

To install and configure the collector, see the JetStream article CrowdStrike AIDR Integrations .

On the collector details page, copy the AIDR API token and base URL from the Config tab. Use these values when you configure the CrowdStrike AIDR guardrail in JetStream.

AIDR Findings

On the Findings page, you can identify JetStream gateway events by filtering on Collector Type jetstream_gateway:

JSON representation of an example JetStream gateway event in Findings

{
  ...
  "collector_type": "jetstream_gateway",
  "collector_name": "My JetStream collector",
  ...
}

You can view collector event data in AIDR Findings and Visibility:

• Findings - View individual events, filter by collector type, and inspect detection details.
• Visibility - Explore relationships between logged data attributes and view metrics in AIDR dashboards.

Next-Gen SIEM

JetStream gateway events appear in Next-Gen SIEM with this parsed field:

• Vendor.collector_type - jetstream_gateway

Example JetStream gateway event in Next-Gen SIEM

{
  ...
  "agent.type": "jetstream_gateway",
  "agent.name": "My JetStream collector",
  "Vendor.collector_type": "jetstream_gateway",
  "Vendor.collector_name": "My JetStream collector"
  ...
}

To query JetStream gateway events in the Falcon console, go to Next-Gen SIEM > Advanced event search, select All as the source, and enter:

Next-Gen SIEM query - JetStream gateway events

#repo="aidr"
| event_type="AIDRPromptDataEvent"
| agent.type="jetstream_gateway"

For more information, see Next-Gen SIEM .

Next steps

• View collected data on Visibility and Findings pages. Analyze it in Next-Gen SIEM to decide on further implementation steps.

• Determine which policy to apply:

  • Start with monitoring policies and report actions.
  • Apply protection to identified risks by enforcing blocking and data transformation actions based on your organization’s AI usage guidelines.

• For more information, see Collector Categories.