Skip to main content

Get Started with AIDR for Workforce

Overview​

The AIDR browser collector is a lightweight browser extension that you install on managed endpoints to capture AI interactions in supported browsers and send data to AIDR for visibility and policy enforcement.

You can use the AIDR browser collector to monitor and analyze employee use of web-based AI tools like ChatGPT, Claude, Gemini, and other supported providers in managed enterprise environments. Based on the analysis, you can apply policies to protect your organization from risks identified in user inputs.

This guide covers installing a browser collector by adding the AIDR Chrome browser extension to Google Chrome or Microsoft Edge on your machine. You will:

  • Verify the browser collector reaches a successful deployment state.
  • View AI activity captured by the collector in the AIDR console event logs.

You can apply this experience when deploying browser collectors at scale using enterprise endpoint management tools.

Requirements​

To start monitoring employee AI usage using browser collectors, ensure you have:

  • A customer account in one of the supported CrowdStrike clouds:
    • US-1
    • US-2
    • EU-1
  • AIDR for Workforce Falcon subscription
  • AIDR Admin role explicitly assigned to your Falcon user account for the current customer
  • Supported operating system:
    • Windows
    • macOS
  • Supported browsers:
    • Google Chrome
    • Microsoft Edge
  • Admin privileges on the user machine(s), necessary for updating system-level configuration:
    • Registry on Windows
    • Configuration profile on macOS
note:

For quick evaluation and testing, this guide covers deployment of the AIDR Chrome extension on your machine.

You can deploy AIDR browser collectors in organizations with managed endpoints. For production deployment in enterprise environments, use supported device management tools:

  • Microsoft Intune (cross-platform)
  • JAMF (macOS)
  • Chrome Enterprise (browser-specific)

These options are outlined on the collector Install tab in the AIDR console.

note:

The AIDR browser extension must be installed and used independently from the Falcon Sensor.

Register browser collector​

In the Falcon console, click Open menu (☰) and go to

AI detection and response > Collectors .

  1. On the Collectors page, click + Collector.

  2. Choose Browser as the collector type, then select the browser you want to support (Chrome, Edge) and click Next.

  3. On the Add a Collector screen:

  1. In the Sites section, leave all AI provider sites set to Use Policy.

    note:

    The Sites section lists supported AI provider websites that the extension can monitor. Each site can be set to one of the following modes to use or override the collector-level policy rules:

    • Use Policy (default) - Apply the collector's policy rules to this site. User prompts and AI system responses are sent to AIDR for analysis and logging. User prompts may be blocked or transformed. To see how your collector policy rules are defined, find the policy you assigned to your collector on the Policies page in the AIDR console.
    • Monitor Only - Apply the collector's policy rules to this site in report-only mode. User prompts and AI system responses are sent to AIDR for analysis and logging. The user experience isn't affected.
    • Discovery - Skip sending AI traffic to AIDR. Only record that users visited the site.
    • Disabled - Ignore this site entirely. No monitoring or logging is done.

  2. Click Save to complete collector registration.

This opens the collector details page, where you can:

  • Copy credentials and AIDR base URL from the Config tab to communicate with AIDR APIs.
  • View installation instructions for the collector type on the Install tab.
  • Update the collector name, its logging preference, and reassign the policy.
  • Follow the policy link to view the policy details.
  • View the collector configuration activity logs.

If you need to return to the collector details page later, select your collector from the list on the Collectors page.

Deploy collector​

To deploy a browser collector, you must:

  • Install the browser extension.
  • Save AIDR collector configuration in the extension's Managed storage.

Select Install option​

On the collector details page, switch to the Install tab, which provides instructions, links, and templates for common deployment methods.

Select the Self-Service option to quickly evaluate the collector on your own machine before deploying it at scale. This option:

  • Introduces the key browser collector deployment steps
  • Requires no management tools
  • Lets you perform both installation and configuration steps manually on your machine
  • Describes the extension deployment statuses and functionality, also applicable to production deployments using enterprise management tools
Self-service limitations:

Self-service deployment is intended for testing and evaluation purposes. It isn't a supported option for production deployments.

The first time you select this option, you must acknowledge these limitations in a confirmation dialog before proceeding.

tip:

For enterprise environments with device management, follow the instructions for a supported management tool on the Install tab.

Install browser extension​

The AIDR collector for Google Chrome and Microsoft Edge is a Chrome extension in the Chrome Web Store.

  1. Use the Get the AIDR Extension link to open the extension page in Chrome Web Store.
  2. Click Add to Chrome (or Add to Edge) to install the extension in your browser.

Once installed, the extension will appear under Extensions in your browser toolbar (the puzzle piece icon in the top-right corner) and in the list of installed extensions at chrome://extensions (or edge://extensions).

Configure browser extension​

  1. Return to the Install tab and download the configuration file for your operating system:

    • macOS - AIDR Chrome Profile (.mobileconfig)
    • Windows - AIDR Windows registry file (.reg)

    This file contains the collector instance configuration, including credentials to authenticate the extension with the AIDR service.

  2. Apply the configuration:

    • macOS

      1. Double-click the downloaded configuration profile (.mobileconfig), then activate it in System Settings > General > Device Management > Profiles. If a previous profile for this extension exists, remove it from this location first.

        The exact path may vary depending on your macOS version.

    • Windows - Double-click the registry file (.reg) to merge it into the Registry and confirm the prompts.

      warning:

      The registry file modifies the Windows Registry under the extension-specific key path. This doesn't affect other settings, but as a precaution, you can make a registry backup before applying the file. If you're unsure how to back up the Registry, contact your IT or system administrator.

  3. Fully close and restart your browser for the settings to take effect.

Verify deployment status​

Extension status page​

In the browser toolbar, click Extensions (the puzzle piece icon in the top-right corner) and select AIDR to open the extension status page showing:

  • CrowdStrike AIDR - Extension vendor and name
  • Version - Semantic version number (for example, 0.6.4). The first two digits indicate the major and minor feature releases, and the last digit indicates a patch with improvements and/or bug fixes.
  • Device - Unique identifier for this extension instance, used to identify the collector instance in AIDR logs and findings. The device ID is re-generated when the extension is re-installed. Collector instances are listed on the collector details page under the Devices tab.
  • UserId - Identifier assigned to the userId field in the extension managed storage. If no userId is configured, this field isn't displayed.
  • One of the status values in the top right, indicating the current state of the extension.

Status progression flow​

  1. Deployment
  2. Configuration check
  3. Registration
  4. Site monitoring

Unsuccessful deployment​

Not configured​

The extension has no configuration in its managed storage.

  1. Verify that the configuration profile or registry changes were properly applied to the system.

    Check the following OS and browser-specific locations:

    • macOS - Managed preference plist files

      Google Chrome
      plutil -p /Library/Managed\ Preferences/<user>/com.google.Chrome.extensions.folndgmoekgkipoolphnkclopeopkecc.plist
      Microsoft Edge
      plutil -p /Library/Managed\ Preferences/<user>/com.microsoft.Edge.extensions.folndgmoekgkipoolphnkclopeopkecc.plist
      Example configuration
      {
        ...
        "registrationIdentity" => "eyJzIj...YiOjF9"
        "urlTemplate" => "https://api.crowdstrike.com/aidr/aiguard"
        "userFullName" => "<user-full-name>"
        "userId" => "<user-id>"
      }

    • Windows - Registry keys

      Google Chrome (PowerShell)
      Get-ItemProperty -Path "HKLM:\Software\Policies\Google\Chrome\3rdparty\extensions\folndgmoekgkipoolphnkclopeopkecc\policy"
      Microsoft Edge (PowerShell)
      Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\folndgmoekgkipoolphnkclopeopkecc\policy"
      Example configuration
      urlTemplate          : https://api.crowdstrike.com/aidr/aiguard
      registrationIdentity : eyJzIj...I6MX0=
      userId               : <user-id>
      userFullName         : <user-full-name>
      ...

    Next steps:

  2. Verify the extension managed storage has been updated.

    1. In your browser address bar, go to chrome://extensions (or edge://extensions).
    2. Enable Developer mode.
    3. In the AIDR extension card, click service_worker.
    4. In the DevTools console for the background service worker, switch to the Application tab.
    5. Expand Extension storage and click Managed.
    6. Verify the storage keys are populated.

    • Required fields:

      • registrationIdentity - Encoded credentials the extension uses to authenticate with the AIDR service and obtain an authorization token
      • urlTemplate - AIDR API base URL

      You can find collector-specific values for registrationIdentity and urlTemplate under the Install tab on the collector details page in the AIDR console. Configuration files and templates available on the Install tab are pre-populated with these values.

    • Optional user identity fields that appear in AIDR event logs:

      • userId - User identifier (for example, email address). Appears in AIDR logs and findings.
      • userFullName - User's display name. Appears in AIDR logs and findings.
      note:

      Downloaded configuration files are pre-populated with values from the current session:

      • urlTemplate - Set to the AIDR API URL for your CrowdStrike cloud.
      • registrationIdentity - Set to collector-specific credentials.
      • userId and userFullName - Set to the current AIDR console user's information.

      If you distribute the configuration file to other users, update the userId and userFullName fields to match the target user's identity. In production deployments, you typically set these values dynamically per user using variables in endpoint management tools or scripts.

    Next steps:

    • If the extension managed storage isn't populated, fully close and restart your browser.
    • If the issue persists, contact your IT or system administrator.
Invalid configuration​

The configuration exists but is malformed due to invalid format or missing value for registrationIdentity or urlTemplate.

Next steps:

Error - registration​

Device registration failed due to network issues or invalid credentials provided in:

  • registrationIdentity
  • urlTemplate

Next steps:

  • Check network connectivity to the AIDR service.
  • Ensure you configured your extension with the correct values from the Install tab on the collector details page. You can check your extension configuration as described for Not configured status. Try to Download and apply the collector configuration again.

Successful registration​

Pending approval​

The extension instance is registered but awaiting admin activation in the AIDR console.

By default, devices are auto-approved and activated, but if auto-approval isn't enabled or this extension instance has been disabled, it remains in this state until activated.

Next steps:

  • On the collector details page, under Devices, find the extension instance by its ID in the list of devices. Open the menu (⋮) in the device row and select Activate.

    tip:

    When activating a collector instance, ensure the device ID shown in the AIDR console matches the one on the extension status page.

Error - logging​

The extension is registered but can't send monitoring data from a provider site to the AIDR service. This could be due to connectivity issues.

Next steps:

  • Check network connectivity to the AIDR service.

Successful deployment​

After successful installation and configuration, the status progresses to:

Configured​

The extension has valid configuration but hasn't obtained an access token yet. This is a normal transitional state during extension startup. It progresses to Ready automatically within minutes if the configuration values are valid.

note:

Invalid configuration values result in Unsuccessful deployment.

Ready​

The extension is configured, authenticated, and ready to monitor supported AI sites. There is no activity detected yet.

Active​

The extension is operational and monitoring AI interactions when the user is interacting with a supported provider site.

Verify data flow​

A properly deployed collector captures user input and AI service responses on supported provider sites and sends the traffic data to AIDR for analysis. The data is processed according to your collector policy rules, and the results are logged. If the collector's Logging is set to Log with prompt data, the user input and the AI response are included in the logs.

Provider website​

Visit a supported provider site (for example, ChatGPT or Claude ) and start interacting with the chat application.

Browser UI​

Depending on the collector policy, the AIDR collector may or may not visibly affect the end user experience in the standard browser UI:

  • If No Policy, Log Only is assigned, or your selected policy rule actions are all set to Alert and Report, you won't see any visible effects from the AIDR collector.
  • If your policy rules have blocking or data-transforming actions, and a rule is matched, you may see blocked or redacted prompts and unexpected responses where sensitive values have been removed before reaching the AI system.

Next steps:

If you don't see AIDR policies applied to the user input:

  • Check Input Rules for the policy assigned to your collector.

    tip:

    You can identify your extension instance by:

    • Matching the extension urlTemplate value and the AIDR cloud domain
    • Switching to the correct customer account in the Falcon console (CID)
    • Selecting the correct collector on the Collectors page in the AIDR console
    • Matching the device ID displayed on the extension status page and in the AIDR console for a registered device on the collector details page under Devices
Extension DevTools​

Use the extension DevTools to confirm that it's active and sending data to AIDR:

  1. In your browser address bar, go to chrome://extensions (or edge://extensions).
  2. Enable Developer mode.
  3. In the AIDR extension card, click service_worker to open its developer tools.
  4. In DevTools, switch to the Network tab.
  5. Check for outbound requests to and responses from the AIDR APIs while interacting with a supported AI provider. You may see the following request names:

    • check - Authenticating with the AIDR service and obtaining an authorization token

    • guard_chat_completions - Sending user input or AI system response to AIDR for analysis

      You can inspect the collector payload under the Payload tab and AIDR API responses under the Preview and Response tabs.

      tip:

      See AIDR APIs documentation to better understand the content of the payloads and responses.

Next steps:

If you don't observe network traffic to AIDR APIs from the correctly configured extension, it may be due to:

  • Changes on the provider site - Contact AIDR support .
  • Your machine policies blocking extension functionality - Contact your IT or system administrator.

AIDR console​

In the AIDR console, you can see the detailed event logs saved by your collector, visualize them in a Sankey dashboard, and see metrics associated with the log data.

Data flow timing:

Data appears in AIDR only when users visit and interact with AI provider sites. Installing the extension alone doesn't create data flow.

View detailed logs​

Click Findings in the top menu to review events processed by AIDR. You can identify your collector logs by attributes associated with your collector and the provider, for example:

  • COLLECTOR TYPE - (for example, Chrome)
  • APPLICATION NAME - Provider service name (for example, ChatGPT)
  • COLLECTOR NAME - Name you gave to your collector
  • TIME - Time of the request

You can see the results of AIDR processing in the following columns:

  • STATUS - Policy decision:
    • Allowed - No risks were detected, and the user prompt or AI system response is allowed by AIDR.
    • Reported - Risks were detected, and the detection results are saved in logs, but the user prompt or AI system response is allowed by AIDR.
    • Blocked - Risks were detected, and AIDR responded with a blocked result. Blocking actions set in policy rules are automatically enforced in Browser, MCP, and (depending on configuration) Gateway collectors.
    • Alerted - Blocked result was logged but not enforced in Report Only mode .
    • Transformed - Sensitive data or malicious references were detected and redacted or defanged. The user prompt or AI system response was allowed with the transformed data.
  • FINDINGS - Detector(s) that identified the risks. If no detections were made and the request was allowed, No detections is displayed.

You can expand each event log and see additional details, including:

  • User prompt or AI response data - If the collector's Logging is set to Log with prompt data, the event logs contain:

    • Guard Input - Original prompt or response submitted to AIDR
    • Guard Output - Processed response, present only if the data was transformed; otherwise, null

  • Metadata associated with the request, including:

    • User - Username saved in the extension managed storage
    • AIGuard Config
      • policy - Policy assigned to the collector
    • Findings - Detailed detections report
    • Extra Info
      • app_name - Provider website application name
      • user_name - User's full name saved in the extension managed storage
      • site_url - Provider website location

Use the reload icon to refresh the event log table.

Learn more about the Findings page in the Logs & Findings documentation .

Visualize your data​

Click Visibility in the top menu to explore patterns in AI data flows processed by AIDR and metrics associated with this data.

In the interactive Sankey diagram, you can visualize the relationships between different entities captured in the event logs by selecting up to three attributes from the event metadata. For example, you can connect User Name - Application Name - Status to see which user visited which AI provider and what outcomes the AIDR processing produced.

Learn more about visualizing AI flows, supported metadata attributes, and metrics dashboards in the Data Flows & Dashboards documentation .

Uninstall collector​

When you're done testing, remove the browser extension and its system configuration.

  1. Remove the browser extension in your browser's extension manager, the same way you would remove any other Chrome or Edge extension.

  2. Remove the system configuration:

    • macOS - Remove the configuration profile in System Settings > General > Device Management > Profiles. The exact path may vary depending on your macOS version.

    • Windows - Delete the registry key for the browser you used.

      warning:

      This modifies the Windows Registry. You can make a registry backup before proceeding. If you're unsure how to back up the Registry, contact your IT or system administrator.

      Run the following command in a PowerShell session as Administrator:

      Remove the registry key for Chrome
      Remove-Item -Path "HKLM:\Software\Policies\Google\Chrome\3rdparty\extensions\folndgmoekgkipoolphnkclopeopkecc" -Recurse
      Remove the registry key for Edge
      Remove-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\folndgmoekgkipoolphnkclopeopkecc" -Recurse

Next steps​

  • View collected data on Visibility and Findings, and analyze it in NextGen SIEM to decide on further implementation steps.

  • Determine which policy to apply:

    • Start with monitoring policies and report actions.
    • Apply protection to identified risks by enforcing blocking and data transformation actions per your organization’s AI usage guidelines.

  • Learn more about collector types and deployment options in the Collectors documentation.

©2026 CrowdStrike. All rights reserved.

PrivacyTerms of UseLegal Notices