📋 Prerequisites

• An active Ayzal AI Agentic SOC Platform account with API key
• CrowdStrike Falcon with Event Streams access

Option 1: Using Fusion SOAR (Recommended)

1. Log in to Falcon Console → Fusion → Workflows
2. Click Create Workflow
3. Add trigger: Detection → New Detection
4. Add action: Webhook
5. Configure URL: https://api.ayzalai.com/api/integrations/crowdstrike
6. Add header: X-API-Key: YOUR_KEY
7. Save and activate the workflow

Option 2: Using Event Streams (Legacy)

1. Log into Falcon Console
2. Navigate to Event Streams
3. Create a new Custom Event Stream
4. Configure:
   Event Type: DetectionSummaryEvent
Webhook URL: https://api.ayzalai.com/api/integrations/crowdstrike
Auth Header: x-api-key = YOUR_API_KEY
5. Enable the stream

✅ Result: Check your Agentic SOC dashboard — detections will appear as alerts within seconds.

Supported Detection Types

• Malware detections
• Suspicious process execution
• Credential dumping attempts
• Lateral movement detection
• All Falcon detection summary events

⚠️ Make sure your API key has active status in Ayzal AI Agentic SOC Platform Settings.