CrowdStrike Falcon
ANTS Platform works alongside CrowdStrike Falcon in three ways:
| Capability | What it gives your analysts | Set up in |
|---|---|---|
| Falcon identifiers on events | The Falcon agent ID (AID), hostname, serial number and user principal name on every event, so an ANTS alert leads straight to the same host and person in Falcon | Discover AI desktop agents |
| Falcon Next-Gen SIEM | AI events, endpoint events, alerts and audit logs pushed within seconds | SIEM Push |
| Falcon Fusion SOAR | A signed JSON webhook on each defined policy violation, to start a Fusion workflow | Policy Violation Webhooks |
Identifiers on every event
Hostnames can change or repeat. Falcon's own unique machine ID is the agent ID (AID). When the Falcon sensor is installed on a device, the Discover AI macOS and Windows agents read its AID locally and report it at every check-in. ANTS Platform stores it on the device record and keeps it current.
Every event ANTS Platform sends out about an enrolled device or a known user carries these identifiers:
| Identifier | Field | Matches in Falcon |
|---|---|---|
| Falcon agent ID | device.falconAid | The host's AID |
| Hostname | device.hostname | The host name |
| Serial number | device.serialNumber | The host's serial number |
| User principal name | user.userPrincipalName | The user name on the host |
That covers SIEM push events and policy violation webhooks, so the pivot works inside Falcon and your playbooks, not only inside ANTS Platform.
Falcon agent ID collection is off by default, because it reads additional data from employees' devices. On a deployment managed by ANTS Platform, ask your ANTS Platform team to turn it on for your deployment. On a self-hosted deployment, your operator turns it on.
Limits.
- Only the macOS and Windows desktop agents can read the AID. Devices with only a browser extension report hostname and serial number from the managed settings the enrollment script writes, but not the AID.
- A device without the Falcon sensor has no AID.
device.falconAidisnullfor it.
Falcon Next-Gen SIEM
SIEM push sends ANTS Platform events to Falcon Next-Gen SIEM through an HEC / HTTP Event Connector, within seconds of each event.
Add a connector in Falcon
In the Falcon console, open Next-Gen SIEM > Data onboarding and add an HEC / HTTP Event Connector data connector with a JSON parser. Generate its API key and copy the API URL and the key.
Connect ANTS Platform
In ANTS Platform, go to Organization Settings > Integrations > SIEM Push. Paste the URL and the key, choose the event types and save.
Every event carries the identifiers above. In Next-Gen SIEM, join on event.device.falconAid to reach the host. See SIEM Push for event types, the schema and delivery.
Falcon Fusion SOAR
A policy violation webhook calls a URL with a signed JSON payload each time a violation you selected happens: a guardrail violation detected or blocked, or a Discover AI device alert. Filter by category and minimum severity so only what you choose reaches Fusion.
Point the webhook at the endpoint your Fusion SOAR workflow receives requests on. In the workflow, use violation.device.falconAid to act on the exact host and violation.user.userPrincipalName to find the person, for example to open a case, notify the manager or contain the device. Alerts pushed to Next-Gen SIEM can also start Fusion workflows from there.
See Policy Violation Webhooks for setup, the payload schema and signature verification.
Device posture
Using Falcon device posture, such as the Zero Trust Assessment score, as a condition in ANTS Platform rules is on the roadmap.