← All integrationsINTEGRATION · SECURITY OPERATIONS

Kapālins for CrowdStrike

Falcon already watches the endpoint and the network. Kapālins adds the AI layer it cannot see: prompts carrying customer data, injection attempts, unapproved models and agent tool calls, pushed into Falcon Next-Gen SIEM as structured events your analysts query next to everything else.

See it governed liveSetup in four steps

AI signal inside Falcon

Findings arrive through the Next-Gen SIEM structured ingest endpoint, one event each, with severity, person, rule and evidence.

Mapped to MITRE ATLAS

Each finding carries the ATLAS technique and the plane that caught it, so AI attacks sit on the same kill chain as the rest.

Nothing pulled, nothing doubled

Kapālins only pushes. Every event is deduplicated on its id, and every attempt is recorded in the push log.

WHAT ARRIVES

What lands in CrowdStrike.

Each incident carries its severity, the person, the rule that fired, what was stopped, and a link back to the evidence. "Ship to ITSM" on the card sends it on demand; findings you choose are pushed as they happen.

  • Sent as the Falcon Next-Gen SIEM structured ingest endpoint
  • Credential: an ingest token and your Falcon ingest URL
Kapālins incidents: sensitive data stopped before it left
Incidents in the pilot tenant: sensitive data stopped before it reached an AI service. Personal addresses masked.
CONTEXT

Mapped to the attack. Priced in dollars.

Every finding carries the MITRE ATLAS technique it belongs to and the plane that caught it. Click the technique and Kapālins shows its residual risk and a modelled annual loss, so the SOC can rank AI findings by what they could cost.

  • Bayesian FAIR on your own telemetry, labelled as modelled
  • Prompt injection, jailbreak, tool misuse, data exfiltration
Kapālins Threat Map: a MITRE ATLAS technique opened to its modelled loss exposure
Console replay · illustrative data
A replay of the Kapālins console: posture, the MITRE ATLAS matrix, then one technique opened to its residual risk and a modelled annual loss from Bayesian FAIR with sector priors. Loss figures are modelled; key names are illustrative.
SOURCE

Everything behind the finding.

The full record stays in Kapālins: the request, the verdict and the rule, so an analyst in your SIEM can pivot to the evidence.

  • Nothing is pulled from your SIEM
Kapālins Logs: one timeline of AI requests and policy verdicts
The Kapālins timeline in the pilot tenant on production. Personal addresses masked.
Setup

Four steps.

  1. Create the destination credentialAn ingest token and your Falcon ingest URL, created in CrowdStrike.
  2. Add the destinationSecurity operations › CrowdStrike › paste the credential and endpoint.
  3. Choose what to pushFindings, blocks or incidents, with a minimum severity.
  4. Send a testKapālins pushes a test event and shows the response.
Request a briefing

See CrowdStrike governed in thirty minutes.

Bring the person who holds the credential. We connect it live and watch the first events land.

Request a briefing All integrations
FAQ

Questions buyers ask.

Does Kapālins read anything from CrowdStrike?

No. The integration is one-way: Kapālins pushes, nothing is pulled.

Can I limit what is pushed?

Yes. Choose the finding types and the minimum severity; the rest stays in Kapālins.

What if a push fails?

The attempt and the response are recorded in the push log and shown on the integration; the next attempt retries it.