ShadowAI Defense GitHub
← All detections
DET-CS-FALCON-002 CrowdStrike Falcon DLP config Severity: High

CrowdStrike Falcon Data Protection — sensitive content to AI domains

Falcon Data Protection policy detecting sensitive-content uploads to consumer AI domains.

Rule

# Falcon Data Protection — Policy: 'Sensitive content to AI domains'
#
# Source: Endpoint (browser, desktop AI clients)
# Destination: Domains in (chat.openai.com, claude.ai, gemini.google.com, perplexity.ai,
#                          chatgpt.com, copilot.microsoft.com, deepseek.com, qwen.ai)
# Content patterns:
#   - PII detectors: SSN, SIN, CCN, IBAN, IP-internal
#   - Source code detectors: file extensions .py/.ts/.go/.java in browser-upload events
#   - Custom content classifiers: Internal-Project-Codenames, Customer-ID patterns
#
# Actions:
#   - Audit-only for 14 days
#   - Then Block-with-override; user prompt explains policy, links to approved tools
#   - Generate Falcon Detection event; route to AI Governance triage queue

How it works

CrowdStrike Falcon Data Protection (formerly Flow) covers a similar workflow to Purview Endpoint DLP for non-Microsoft-stack environments. Pair with policy + comms rollout.

Required data sources

  • CrowdStrike Falcon Data Protection module

Prerequisites

  • Falcon Data Protection licensed and enabled
  • Sensor at version supporting Data Protection
  • Content classifiers configured (PII detectors out-of-the-box; custom classifiers require ~30 days of training)
  • Approved-tool launch communicated prior to enforcement

Expected volume

Comparable to DET-MS-PV-001: ~5–30 events/day per 10k seats after tuning.

False-positive guidance

Same categories as Purview: internal docs with example PII, sanitized code, test accounts, cross-language false matches.

Tuning steps

  1. Audit-only for 14 days, classify each event.
  2. Refine custom classifiers.
  3. Move to Block-with-override.
  4. Hard block only for regulated data classes (PHI, PCI primary account numbers).

Framework mappings

  • NIST AI RMF: GOVERN-4.1, MEASURE-2.7, MANAGE-2.2
  • ISO/IEC 42001: 8.2, 8.3
  • MITRE ATT&CK: T1567.002
  • NIST CSF: DE.CM-3, PR.DS-5

Related AI Controls Catalog entries