https://cybertoolchain.io/tools/crowdstrike New releases and features in CrowdStrike, tracked by The Cyber Toolchain. en Mon, 05 Oct 2026 08:18:19 GMT https://developer.crowdstrike.com/api-reference/overview/ https://developer.crowdstrike.com/api-reference/overview/ Mon, 05 Oct 2026 08:18:19 GMT CrowdStrike: Adds an `Application Abuse Exclusions` API group under Prevention Policy. • Adds an `Audit` API group with 86 operations for querying audit events. • Adds a `Prevention Policy` API group for managing host prevention policies. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdstrike https://developer.crowdstrike.com/api-reference/overview/ https://developer.crowdstrike.com/api-reference/overview/ Sun, 04 Oct 2026 14:00:01 GMT CrowdStrike API adds Seraphic browser security, Scanning Orchestrator, and Application Abuse Exclusions with 142 new operations⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds 16 API operations for host management, detection investigation, incident response, and sensor tracking. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdstrike https://developer.crowdstrike.com/api-reference/overview/ https://developer.crowdstrike.com/api-reference/overview/ Sun, 04 Oct 2026 08:12:13 GMT CrowdStrike API adds Seraphic (enterprise browser, 40 ops), Scanning Orchestrator, and Network Scan Detections/Containment surface areas⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Network Scan Detections API operations for reviewing scan detections and reporting on scan results. • Adds Network Containment API operations for managing network containment allowlists across scanned zones. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdstrike https://developer.crowdstrike.com/api-reference/overview/ https://developer.crowdstrike.com/api-reference/overview/ Sat, 03 Oct 2026 13:07:24 GMT CrowdStrike API gains Seraphic (40 ops), Scanning Orchestrator, and expanded Audit/Prevention Policy surfaces⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Seraphic integration with 40 API operations for managing enterprise browser security across a fleet.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Scanning Orchestrator API surface for coordinating scan workflows. • Adds Application Abuse Exclusions API operations for defining exclusions against application abuse detections. • Expands Audit API surface to 86 operations. • Adds Prevention Policy API operations to the platform. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdstrike https://www.crowdstrike.com/en-us/blog/falcon-aidr-protects-copilot-studio-agents-and-claude-code/ https://www.crowdstrike.com/en-us/blog/falcon-aidr-protects-copilot-studio-agents-and-claude-code/ Falcon AIDR extends AI visibility and control to Microsoft Copilot Studio, Claude Code, and the Falcon browser extension. • Integrates Falcon AIDR with Microsoft Copilot Studio as an external threat detection provider, checking tool names and input parameters against policy and returning allow/block decisions before an agent executes a tool call. • Connects Falcon AIDR to Claude Code's hook event system to inspect and block prompts and tool activity in real time, configured via a JSON block in the Claude Code settings file with no agent install required. • Adds Falcon AIDR capability to the Falcon browser extension, enabling monitoring and control of browser-based AI activity managed through the Falcon console with policy assignment aligned to existing host groups. • Feeds Copilot Studio, Claude Code, and browser extension AI activity data into Falcon Next-Gen SIEM to support agentic SOC workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdstrike https://www.crowdstrike.com/en-us/blog/denying-the-worm-sandworm-mode-and-ai-toolchain-supply-chain-attacks/ https://www.crowdstrike.com/en-us/blog/denying-the-worm-sandworm-mode-and-ai-toolchain-supply-chain-attacks/ CrowdStrike adds detections for SANDWORM_MODE, a multi-stage npm supply chain worm targeting AI coding assistants and LLM toolchains. • Adds indicators-of-attack (IOA) coverage for SANDWORM_MODE, detecting a multi-stage npm supply chain worm that targets AI-augmented CI/CD pipelines including GitHub Actions, Cursor, Claude Code, and Windsurf. • Deploys process-tree-ancestry-based detections for Node.js runtime behaviors characteristic of SANDWORM_MODE, including obfuscated loader execution, in-memory payload staging via /dev/shm, and rogue MCP server registration. • Extends detection coverage to AI toolchain compromise behaviors: rogue MCP server injection into Claude Desktop, Cursor, VSCode, and Windsurf configuration files, and LLM API key harvesting from environment variables and .env files. • Adds detection for SANDWORM_MODE persistence mechanisms, including malicious git hook injection via ~/.git-templates/hooks/ and manipulation of git config --global init.templateDir. • Introduces detection for multi-channel exfiltration behaviors including HTTPS POST to attacker infrastructure, GitHub private repository mirroring, and DNS tunneling with Base32 encoding and domain generation algorithm fallback. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdstrike https://www.crowdstrike.com/en-us/blog/aidr-how-crowdstrike-is-defining-next-era-of-cybersecurity/ https://www.crowdstrike.com/en-us/blog/aidr-how-crowdstrike-is-defining-next-era-of-cybersecurity/ CrowdStrike launches Falcon AIDR, a new runtime security category detecting and blocking threats targeting and originating from AI agents across endpoint, SaaS, and cloud. • Introduces Falcon AI Detection and Response (AIDR), a new security category providing unified runtime visibility, detection, and automated response for AI agents across endpoints, SaaS, and cloud environments. • Discovers shadow AI by illuminating employee agent and tool usage across endpoints, AI gateways, MCP servers, cloud environments, and Copilot ecosystems. • Enforces granular attribute-based access controls aligned to AI governance policy, including policy based on user and model version. • Automatically detects and blocks confidential data, PII, secrets, keys, and regulated data before exposure, with multiple redaction methods including format-preserving encryption. • Generates comprehensive audit trails of AI runtime behavior for compliance, forensics, and continuous improvement. • Upcoming: deep Falcon sensor integration to discover and monitor AI agents (Claude Code, Cursor, Copilot, Kiro, Codex, shadow agents) at the OS/kernel level with a live fleet inventory, risk scoring, behavioral detection, and a unified agent execution chain + OS process tree causal graph for investigation and enforcement. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdstrike https://www.crowdstrike.com/en-us/blog/new-in-falcon-cloud-security-expanding-multi-cloud-coverage/ https://www.crowdstrike.com/en-us/blog/new-in-falcon-cloud-security-expanding-multi-cloud-coverage/ Falcon Cloud Security June 2026 expands real-time CSPM, Cloud Risks, DSPM, and CIEM to Azure and Google Cloud. • Extends real-time CSPM to Google Cloud, surfacing new assets, misconfigurations, and cloud risks within minutes of introduction — matching existing AWS and Azure coverage. • Expands correlated Cloud Risks breach-path detection to Azure and Google Cloud, previously limited to AWS environments. • Adds adversary-informed risk prioritization to Azure and Google Cloud, mapping known adversary activity to cloud attack paths across all three major cloud providers. • Introduces DSPM for Google Cloud Storage, enabling agentless discovery, sensitive data classification, and exposure identification alongside existing AWS and Azure DSPM coverage. • Adds CIEM for Azure, allowing security teams to analyze permissions, understand effective access, and identify excessive entitlements across AWS and Azure using a unified workflow. • Extends container image assessment to Windows container workloads, building on existing Linux container image assessment capabilities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdstrike https://www.crowdstrike.com/en-us/blog/falcon-exposure-management-now-available-for-third-party-environments/ https://www.crowdstrike.com/en-us/blog/falcon-exposure-management-now-available-for-third-party-environments/ Falcon Exposure Management now supports third-party (non-CrowdStrike) endpoint environments with AI-driven exploitability prioritization. • Extends Falcon Exposure Management availability to organizations using third-party endpoint solutions, removing the requirement to standardize on CrowdStrike agents. • Introduces the Exposure Prioritization Agent, which scores every vulnerability on every asset by exploitability conditions, asset criticality, attack path analysis, and active adversary threat intelligence. • Introduces the Exposure Summary Agent, which generates AI-enhanced summaries of vulnerabilities including threat context, exploitation requirements, and remediation guidance to reduce manual analyst research. • Combines CrowdStrike telemetry with third-party asset and vulnerability data into a single real-time exposure view across endpoints, external assets, cloud, network, OT/IoT, and AI components. • Connects prioritized findings directly to Falcon Fusion SOAR and patching workflows to accelerate remediation from visibility to action. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdstrike https://www.crowdstrike.com/en-us/blog/crowdstrike-announces-continuous-identity-for-ai-agents/ https://www.crowdstrike.com/en-us/blog/crowdstrike-announces-continuous-identity-for-ai-agents/ CrowdStrike extends Continuous Identity to AI agents, AWS cloud infra, and unified non-human identity visibility via Falcon Next-Gen Identity Security. • Introduces Continuous Identity for AI Agents in Falcon Next-Gen Identity Security, authorizing every agent action in real time using SPIFFE and the Shared Signals Framework (SSF) — eliminating standing privileges and preserving human identity/permissions through agent-to-agent delegation. • Expands modern privileged access to AWS cloud infrastructure, dynamically assigning AWS roles or tags per-session based on identity, device posture, Falcon ZTA score, and group membership — with automatic revocation when risk context changes. • Adds support for self-elevation and approval-based access workflows for higher-risk AWS scenarios. • Integrates Falcon AI Detection and Response (AIDR) with Continuous Identity to inspect LLM prompts and intent in real time, triggering access revocation when permission misuse or prompt manipulation is detected. • Introduces unified ownership, visibility, and intelligence across non-human identities (NHIs) — including service accounts, API keys, OAuth tokens, and cloud service principals — to surface owner, contact, and dependency context during threat investigation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdstrike https://www.crowdstrike.com/en-us/blog/crowdstrike-expands-identity-leadership-with-openid-and-idpro/ https://www.crowdstrike.com/en-us/blog/crowdstrike-expands-identity-leadership-with-openid-and-idpro/ CrowdStrike joins OpenID Foundation as Sustaining Member, enabling CAEP-based real-time identity signals across the Falcon ecosystem. • Joins OpenID Foundation as a Sustaining Corporate Member, taking an active role in shaping Shared Signals, AuthZen, and AI & Identity Management working groups. • Joins IDPro to engage directly with identity practitioners and ensure emerging standards are production-ready. • Enables Falcon platform to share real-time security and device posture signals to identity providers and access control systems via the Continuous Access Evaluation Profile (CAEP), allowing access to be revoked or restricted dynamically when threats are detected. • Operates the caep.dev platform, providing developers an open environment to test CAEP transmitter and receiver implementations using open-source components. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/crowdstrike