CrowdStrike

No entries match these filters. Clear filters

1. changelog Oct 5, 2026 · issue 095

   CrowdStrike: Adds an Application Abuse Exclusions API group under Prevention Policy.

   • Adds an Audit API group with 86 operations for querying audit events.
   • Adds a Prevention Policy API group for managing host prevention policies.

   2 details in Everything

2. changelog Oct 4, 2026 · issue 094

   CrowdStrike API adds Seraphic browser security, Scanning Orchestrator, and Application Abuse Exclusions with 142 new operations⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds 16 API operations for host management, detection investigation, incident response, and sensor tracking.

   1 detail in Everything

3. changelog Oct 4, 2026 · issue 094

   CrowdStrike API adds Seraphic (enterprise browser, 40 ops), Scanning Orchestrator, and Network Scan Detections/Containment surface areas⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds Network Scan Detections API operations for reviewing scan detections and reporting on scan results.
   • Adds Network Containment API operations for managing network containment allowlists across scanned zones.

   2 details in Everything

4. changelog Oct 3, 2026 · issue 093

   CrowdStrike API gains Seraphic (40 ops), Scanning Orchestrator, and expanded Audit/Prevention Policy surfaces⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds Seraphic integration with 40 API operations for managing enterprise browser security across a fleet.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Scanning Orchestrator API surface for coordinating scan workflows.
   • Adds Application Abuse Exclusions API operations for defining exclusions against application abuse detections.
   • Expands Audit API surface to 86 operations.
   • Adds Prevention Policy API operations to the platform.
   • Adds Seraphic integration with 40 API operations for managing enterprise browser security across a fleet.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds Scanning Orchestrator API surface for coordinating scan workflows.
   • Adds Application Abuse Exclusions API operations for defining exclusions against application abuse detections.
   • Adds Prevention Policy API operations to the platform.

   1 more in Everything

5. changelog Sep 2, 2026 · issue 063

   CrowdStrike launches coordinated multi-agent SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. investigations, Charlotte AI AgentWorks for Claude, and GPT-5.6 Cyber on Falcon.

   • New shared context layer (built on Enterprise Graph) gives all Charlotte AI domain agents a persistent, shared memory across every agent, investigation, and tenant — what one agent learns, all agents know, enabling coordinated parallel investigations.
   • New Charlotte Agentic SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. provides a single-governed automation workspace for multi-agent SOC workflows.
   • New Charlotte AI AgentWorks lets security teams describe a desired security outcome in natural language and build, test, and refine custom agents grounded in Falcon telemetry — no coding required — then execute those agents directly from Anthropic Claude.
   • Security workflows (triage, enrichment, hunting, response) can now be run conversationally within Claude via Charlotte AI AgentWorks, with results returned inline and full auditability.
   • Falcon platform is coming to the Anthropic Claude Marketplace, allowing Anthropic customers to procure it against existing Anthropic commitments.

   +2 more show less

   • GPT-5.6 Cyber advanced reasoning model is being integrated into the Falcon platform, starting with the CrowdStrike Frontier AI Readiness and Resilience (FAIRR) Service.
   • New Falcon Guardian capability extends CrowdStrike enterprise security to OpenAI Codex agents at the point of execution.

   7 details in Everything

6. changelog Sep 1, 2026 · issue 062

   CrowdStrike launches SafeMind, a paired offensive/defensive agentic AI system built on NVIDIA Nemotron models, native to the Falcon platform.

   • Introduces CrowdStrike SafeMind, an agentic system operating natively in the CrowdStrike Falcon platform that pairs an offensive model (Red Tempest) and a defensive model (Blue Solano) in a closed-loop harness that continuously pits them against each other to improve.
   • Launches Red Tempest, an offensive red-team model built for advanced attack-scenario emulation against AI adversaries, trained on CrowdStrike sensor telemetry, threat intelligence, Falcon Complete MDRMDRManaged detection and response, an outsourced service that monitors security signals, investigates threats and helps respond to incidents. It combines specialist analysts with detection tools. event annotations, and fifteen years of incident response data.
   • Launches Blue Solano, a defensive blue-team model built to protect enterprise assets by autonomously deploying battle-tested defensive measures, trained on the same CrowdStrike cyber dataset.
   • Introduces SafeMind harnesses that operationalize both models in a closed-loop system and also interoperate with third-party frontier and open-source models, giving users model choice while maintaining cost control.
   • Standalone SafeMind models and harnesses will be available to external parties through the Project QuiltWorks program.

   +2 more show less

   • SafeMind is built on NVIDIA Nemotron open models, trained and served on CoreWeave's AI Cloud infrastructure.
   • CrowdStrike reports SafeMind delivers 29% higher detection rate, 6x faster end-to-end remediation, and 99% cost reduction compared to leading frontier and open-source model baselines.

   7 details in Everything

7. undated-3cd143b1 · issue 031

   Falcon AIDR extends AI visibility and control to Microsoft Copilot Studio, Claude Code, and the Falcon browser extension.

   └──▷ HOW TO FIND IT
   Manage Falcon AIDR browser extension coverage across your fleet without a separate workflow by aligning policy to host groups you already use.
   📍In the Falcon console, navigate to Falcon AIDR policy settings, assign AIDR policies to existing host groups, and enable the Falcon browser extension to cover browser-based AI activity.
   • Integrates Falcon AIDR with Microsoft Copilot Studio as an external threat detection provider, checking tool names and input parameters against policy and returning allow/block decisions before an agent executes a tool call.
   • Connects Falcon AIDR to Claude Code's hook event system to inspect and block prompts and tool activity in real time, configured via a JSON block in the Claude Code settings file with no agent install required.
   • Adds Falcon AIDR capability to the Falcon browser extension, enabling monitoring and control of browser-based AI activity managed through the Falcon console with policy assignment aligned to existing host groups.
   • Feeds Copilot Studio, Claude Code, and browser extension AI activity data into Falcon Next-Gen SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. to support agentic SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. workflows.

   4 details in Everything

8. undated-6a01ac0f · issue 022

   CrowdStrike adds detections for SANDWORM_MODE, a multi-stage npm supply chain worm targeting AI coding assistants and LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. toolchains.

   • Adds indicators-of-attack (IOA) coverage for SANDWORM_MODE, detecting a multi-stage npm supply chain worm that targets AI-augmented CI/CD pipelines including GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure., Cursor, Claude Code, and Windsurf.
   • Deploys process-tree-ancestry-based detections for Node.js runtime behaviors characteristic of SANDWORM_MODE, including obfuscated loader execution, in-memory payload staging via /dev/shm, and rogue MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server registration.
   • Extends detection coverage to AI toolchain compromise behaviors: rogue MCP server injection into Claude Desktop, Cursor, VSCode, and Windsurf configuration files, and LLM API key harvesting from environment variables and .env files.
   • Adds detection for SANDWORM_MODE persistence mechanisms, including malicious git hook injection via ~/.git-templates/hooks/ and manipulation of git config --global init.templateDir.
   • Introduces detection for multi-channel exfiltration behaviors including HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. POST to attacker infrastructure, GitHub private repository mirroring, and DNS tunneling with Base32 encoding and domain generation algorithm fallback.

   5 details in Everything

9. undated-fa98e67b · issue 017

   CrowdStrike launches Falcon AIDR, a new runtime security category detecting and blocking threats targeting and originating from AI agents across endpoint, SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally., and cloud.

   • Introduces Falcon AI Detection and Response (AIDR), a new security category providing unified runtime visibility, detection, and automated response for AI agents across endpoints, SaaS, and cloud environments.
   • Discovers shadow AI by illuminating employee agent and tool usage across endpoints, AI gateways, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, cloud environments, and Copilot ecosystems.
   • Enforces granular attribute-based access controls aligned to AI governance policy, including policy based on user and model version.
   • Automatically detects and blocks confidential data, PIIPIIPersonally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations., secrets, keys, and regulated data before exposure, with multiple redaction methods including format-preserving encryption.
   • Generates comprehensive audit trails of AI runtime behavior for compliance, forensics, and continuous improvement.

   +1 more show less

   • Upcoming: deep Falcon sensor integration to discover and monitor AI agents (Claude Code, Cursor, Copilot, Kiro, Codex, shadow agents) at the OS/kernel level with a live fleet inventory, risk scoring, behavioral detection, and a unified agent execution chain + OS process tree causal graph for investigation and enforcement.

   6 details in Everything

10. Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud · issue 002

    Falcon Cloud Security June 2026 expands real-time CSPMCSPMCloud security posture management, checking cloud resources for risky settings and policy violations. It helps teams find exposed services, overly broad permissions and other configuration gaps., Cloud Risks, DSPMDSPMData security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores., and CIEM to Azure and Google Cloud.

    • Extends real-time CSPM to Google Cloud, surfacing new assets, misconfigurations, and cloud risks within minutes of introduction — matching existing AWS and Azure coverage.
    • Expands correlated Cloud Risks breach-path detection to Azure and Google Cloud, previously limited to AWS environments.
    • Adds adversary-informed risk prioritization to Azure and Google Cloud, mapping known adversary activity to cloud attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. across all three major cloud providers.
    • Introduces DSPM for Google Cloud Storage, enabling agentless discovery, sensitive data classification, and exposure identification alongside existing AWS and Azure DSPM coverage.
    • Adds CIEM for Azure, allowing security teams to analyze permissions, understand effective access, and identify excessive entitlements across AWS and Azure using a unified workflow.

    +1 more show less

    • Extends container image assessment to Windows container workloads, building on existing Linux container image assessment capabilities.

    6 details in Everything

11. Falcon Exposure Management Now Available for Third-Party Environments · issue 001

    Falcon Exposure Management now supports third-party (non-CrowdStrike) endpoint environments with AI-driven exploitability prioritization.

    • Extends Falcon Exposure Management availability to organizations using third-party endpoint solutions, removing the requirement to standardize on CrowdStrike agents.
    • Introduces the Exposure Prioritization Agent, which scores every vulnerability on every asset by exploitability conditions, asset criticality, attack pathattack pathA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. analysis, and active adversary threat intelligence.
    • Introduces the Exposure Summary Agent, which generates AI-enhanced summaries of vulnerabilities including threat context, exploitation requirements, and remediation guidance to reduce manual analyst research.
    • Combines CrowdStrike telemetry with third-party asset and vulnerability data into a single real-time exposure view across endpoints, external assets, cloud, network, OT/IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure., and AI components.
    • Connects prioritized findings directly to Falcon Fusion SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. and patching workflows to accelerate remediation from visibility to action.

    5 details in Everything

12. CrowdStrike Announces Continuous Identity for AI Agents · issue 001

    CrowdStrike extends Continuous Identity to AI agents, AWS cloud infra, and unified non-human identitynon-human identityA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. visibility via Falcon Next-Gen Identity Security.

    └──▷ HOW TO FIND IT
    Enable per-session AWS privilege assignment so engineers never hold standing cloud permissions — access is granted only at login and revoked automatically when risk signals change.
    📍In the Falcon console, go to Next-Gen Identity Security › Privileged Access › AWS Integration, connect your AWS SSO, and configure session policies to evaluate ZTA score, device posture, and group membership before dynamically assigning AWS roles or tags.
    Enforce real-time authorization for every AI agent action so a compromised credential or context change (e.g., new vulnerability, HR status update) immediately revokes access before the agent can act.
    📍In the Falcon console, go to Next-Gen Identity Security › Continuous Identity › AI Agents, enable SPIFFE-based agent identity issuance, and configure Shared Signals Framework (SSF) policies to evaluate human entitlements and live risk signals at the moment of each agent action.
    • Introduces Continuous Identity for AI Agents in Falcon Next-Gen Identity Security, authorizing every agent action in real time using SPIFFESPIFFEAn open standard, maintained by the CNCF, for assigning cryptographic identities to workloads in dynamic infrastructure so services can authenticate each other without passwords or static credentials. and the Shared Signals Framework (SSF) — eliminating standing privileges and preserving human identity/permissions through agent-to-agent delegation.
    • Expands modern privileged access to AWS cloud infrastructure, dynamically assigning AWS roles or tags per-session based on identity, device posture, Falcon ZTA score, and group membership — with automatic revocation when risk context changes.
    • Adds support for self-elevation and approval-based access workflows for higher-risk AWS scenarios.
    • Integrates Falcon AI Detection and Response (AIDR) with Continuous Identity to inspect LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. prompts and intent in real time, triggering access revocation when permission misuse or prompt manipulation is detected.
    • Introduces unified ownership, visibility, and intelligence across non-human identitiesnon-human identitiesA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls. (NHIsNHIsA non-human identity, an account or credential used by software or a device rather than a person. Service accounts, workload identities and automation tokens need their own permissions and lifecycle controls.) — including service accounts, API keys, OAuth tokens, and cloud service principals — to surface owner, contact, and dependency context during threat investigation.

    5 details in Everything

13. CrowdStrike Expands Identity Leadership with OpenID and IDPro · issue 001

    CrowdStrike joins OpenIDOpenIDAn open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. Foundation as Sustaining Member, enabling CAEP-based real-time identity signals across the Falcon ecosystem.

    └──▷ TRY IT
    Test a CAEP transmitter or receiver implementation against a live sandbox before integrating Falcon signals into your IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. pipeline.
    copy

    $ https://caep.dev

    • Joins OpenID Foundation as a Sustaining Corporate Member, taking an active role in shaping Shared Signals, AuthZen, and AI & Identity Management working groups.
    • Joins IDPro to engage directly with identity practitioners and ensure emerging standards are production-ready.
    • Enables Falcon platform to share real-time security and device posture signals to identity providersidentity providersA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. and access control systems via the Continuous Access Evaluation Profile (CAEP), allowing access to be revoked or restricted dynamically when threats are detected.
    • Operates the caep.dev platform, providing developers an open environment to test CAEP transmitter and receiver implementations using open-source components.

    4 details in Everything