C

CrowdStrike

Forward Cheqpoint approval events to CrowdStrike Falcon LogScale (Humio) for security event correlation, or trigger Falcon Fusion workflows when high-risk AI agent actions are detected.

Option A: Falcon LogScale (Humio) via HEC

text
Settings → Integrations → CrowdStrike → Enter LogScale endpoint → Save

LogScale HEC endpoint:
  https://<logscale-hostname>/api/v1/ingest/hec

  Authorization: Bearer <your-ingest-token>
  Content-Type: application/json

Cheqpoint sends each approval event as a structured JSON log.

LogScale event format

json
{
  "time": 1760561520,
  "source": "cheqpoint",
  "fields": {
    "requestId":    "req_01j3abc",
    "action":       "run_sql_query",
    "status":       "approved",
    "agentName":    "Analytics Bot",
    "riskScore":    0.65,
    "decidedBy":    "dba@company.com",
    "decisionNote": "Query scoped correctly - approved",
    "createdAt":    "2026-10-15T09:12:00Z"
  }
}

LogScale query: high-risk AI actions

text
// LogScale (Humio) query language
source=cheqpoint riskScore > 0.8
| groupBy([agentName, action], function=count())
| sort(count, order=desc)

Option B: Falcon Fusion workflow trigger

text
# Falcon Fusion can trigger a workflow from a Cheqpoint webhook event.
# Use a custom HTTP trigger in Fusion to receive events:

1. Create a Fusion workflow with an HTTP trigger.
2. Paste the Fusion HTTP endpoint into Cheqpoint:
   Settings → Integrations → Notification URL → Add

3. In the workflow, filter for high-risk rejections:
   condition: event.riskScore > 0.8 AND event.status == "rejected"

4. Actions: alert SOC analyst, quarantine agent API key, or
   call Cheqpoint kill switch API to suspend the agent.

Kill switch via Cheqpoint API (Fusion action)

bash
# Suspend an AI agent from a Fusion workflow or script
curl -X POST https://app.cheqpoint.co/api/agents/<agentId>/kill \
  -H "x-api-key: <connection-key>" \
  -H "Content-Type: application/json" \
  -d '{ "reason": "Suspended by CrowdStrike Falcon Fusion - repeated high-risk rejections" }'

Use cases

  • Correlate AI agent approval events with endpoint telemetry in Falcon LogScale
  • Trigger Falcon Fusion playbooks when agents exhibit suspicious behaviour (repeated rejections, volume spikes)
  • Auto-suspend an AI agent via the Cheqpoint API as a Fusion response action
  • Feed CEF-format Cheqpoint exports into Falcon LogScale via file-based ingestion